ARM® Cortex®-A35 Processor 


Revision: r0p2 


Technical Reference Manual 


ARM 


Copyright © 2015-2017 ARM Limited or its affiliates. All rights reserved. 
ARM 100236_0002_00_en 


ARM? Cortex®-A35 Processor 


ARM” Cortex®-A35 Processor 


Technical Reference Manual 
Copyright © 2015-2017 ARM Limited or its affiliates. All rights reserved. 


Release Information 


Document History 














Issue Date Confidentiality Change 

0000-00 04 December 2015 Confidential First release for r0p0 
0001-00 18 March 2016 Confidential First release for r0p1 
0002-00 04 March 2017 Non-Confidential First release for r0p2 




















Non-Confidential Proprietary Notice 


This document is protected by copyright and other related rights and the practice or implementation of the information contained in 
this document may be protected by one or more patents or pending patent applications. No part of this document may be 
reproduced in any form by any means without the express prior written permission of ARM. No license, express or implied, by 
estoppel or otherwise to any intellectual property rights is granted by this document unless specifically stated. 


Your access to the information in this document is conditional upon your acceptance that you will not use or permit others to use 


the information for the purposes of determining whether implementations infringe any third party patents. 


THIS DOCUMENT IS PROVIDED “AS IS”. ARM PROVIDES NO REPRESENTATIONS AND NO WARRANTIES, 
EXPRESS, IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 
MERCHANTABILITY, SATISFACTORY QUALITY, NON-INFRINGEMENT OR FITNESS FOR A PARTICULAR PURPOSE 
WITH RESPECT TO THE DOCUMENT. For the avoidance of doubt, ARM makes no representation with respect to, and has 
undertaken no analysis to identify or understand the scope and content of, third party patents, copyrights, trade secrets, or other 


rights. 
This document may include technical inaccuracies or typographical errors. 


TO THE EXTENT NOT PROHIBITED BY LAW, IN NO EVENT WILL ARM BE LIABLE FOR ANY DAMAGES, 
INCLUDING WITHOUT LIMITATION ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR 
CONSEQUENTIAL DAMAGES, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING 
OUT OF ANY USE OF THIS DOCUMENT, EVEN IF ARM HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH 
DAMAGES. 


This document consists solely of commercial items. You shall be responsible for ensuring that any use, duplication or disclosure of 
this document complies fully with any relevant export laws and regulations to assure that this document or any portion thereof is 
not exported, directly or indirectly, in violation of such export laws. Use of the word “partner” in reference to ARM’s customers is 
not intended to create or refer to any partnership relationship with any other company. ARM may make changes to this document at 


any time and without notice. 


If any of the provisions contained in these terms conflict with any of the provisions of any signed written agreement covering this 
document with ARM, then the signed written agreement prevails over and supersedes the conflicting provisions of these terms. 
This document may be translated into other languages for convenience, and you agree that if there is any conflict between the 


English version of this document and any translation, the terms of the English version of the Agreement shall prevail. 


Words and logos marked with ® or ™ are registered trademarks or trademarks of ARM Limited or its affiliates in the EU and/or 
elsewhere. All rights reserved. Other brands and names mentioned in this document may be the trademarks of their respective 


owners. Please follow ARM’s trademark usage guidelines at /ttp:/Avww.arm.com/about/trademark-usage-guidelines.php 
Copyright © 2015-2017, ARM Limited or its affiliates. All rights reserved. 

ARM Limited. Company 02557590 registered in England. 

110 Fulbourn Road, Cambridge, England CB1 9NJ. 


LES-PRE-20349 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 2 
reserved. 
Non-Confidential 


ARM? Cortex®-A35 Processor 


Confidentiality Status 


This document is Non-Confidential. The right to use, copy and disclose this document may be subject to license restrictions in 
accordance with the terms of the agreement entered into by ARM and the party that ARM delivered this document to. 


Unrestricted Access is an ARM internal classification. 

Product Status 

The information in this document is Final, that is for a developed product. 
Web Address 


http://www.arm.com 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 3 
reserved. 
Non-Confidential 


Contents 


ARM® Cortex®-A35 Processor Technical Reference 





Manual 

Preface 
ADOULINIS DOOK arenan A A na eee alee 20 
PCO OD ACK iarsan nA EA T O O es ageaetaees 24 
Part A Functional Description 
Chapter A1 Introduction 
AlI -Apouütthe COMECX®-AS5 PlOCOSSOM teicseascaineaieadsacesiancati nir A R A1-28 
Abe: -Foalülo Serene n N A E eeaeesds A1-29 
Ata Implementation OplOnSriasscstsaacsiessarsdsatensgesciacseieat. N A A O ate A1-30 
Al:4 Supported standards-and specmMicatonS psss eisie aa RE ie A1-32 
Ato. ' “WO SUETOAUN CS zac n R Sie ae AE A eee A1-33 
Al G: IDOSIQINASHS ronnan A E cotes va eee o ae rowed oseps kan zebae lava eoeee A1-34 
Al  TPROGUCETOVISIODS: sirean n E E sean apeeancereaeae A1-35 
Chapter A2 Technical Overview 

AZT. COnpPonemMe arra aA ET O O ETE A2-38 
A22: NMGMACES -sorsana inn a a A ARNE A2-42 
A23. -About system COnY Olsena inar ana T A A A OAE A2-44 
A24 Aboutthe Generne HMC znsn arrinin aA a E E A A A2-45 
A25. Abouthe MEMORY Model sisanne e N EN AEN A2-46 

ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 5 

reserved. 


Non-Confidential 


Chapter A3 


Clocks, Resets, and Input Synchronization 





AIT CIOCKS aro saisa cose sesbes teascbiesceieigheseanadegtsataetesdexes-teenceendaetagussbesnteussaedebesiesgeessqaceaigieene’ A3-48 
AS ‘IAPUESVACHOMIZAUOMN soens aana EE E E A3-49 
AZ: ROSEE maneno n AEE EEEE O R O EAT A3-50 
Chapter A4 Power Management 
AALT POWOFGOMAIN Soari riana Aa I EEE EEEE I A4-54 
BAZ POWO MOJO S: aioe an dase AEN ARE EAEE EAEE EETAS A4-57 
A43 Core: Wait for Intnl msiri inarin A4-58 
A44- Core Wall lor EVƏnt vesiccsicsessecccenseanestecoesnesstcensedene ae teeese se dseaneedeenseunes¥acessundaieenee A4-59 
A45 L2 Wal TOP INCMUDT iisonic r oa iooi A4-60 
44.6 -Powering down an individual CONE ssicsicciseszecevesncsessevecscndensevccserveccessetsetveoesscese veces A4-61 
Ad? Poöowemngupanindvidual CONG ssanie r I A AEE A4-62 
A4.8 Powering down the processor without system driven L2 flUSh a...se A4-63 
A4.9 Powering up the processor without system driven L2 flUSh ......e cece ene eeeees A4-64 
A4.10 Powering down the processor with system driven L2 flUSH „a...se seese A4-65 
A4.11 Powering up the processor with system driven L2 flUSh ...... cece eesieereeereens A4-66 
A412 Entermg Dormant MOOG i icos:scenscteccaciecasseo a a a A4-67 
ALIS Exim Dormant mole sesonon aaae A4-68 
A4.14 Event communication using WFE: OF SEV wx.ccccsccssscieesssssiecseses obsdetesorsasanoencenizeeness A4-69 
A4.15 Communication to the Power Management Controller ......ccccccsiee ceeeenneeeenteeees A4-70 
A4.16 STANDBYWEFI[3:0] and STANDBYWFIL2 signals „i... ceeeeeteetnnneeennaees A4-71 
ALIT Qhana fees oah cosets cabs cook tanne anna thant ones sabcabincos tesa tietts ten he esis? A4-72 
Chapter A5 Cache Behavior and Cache Protection 
AST Cached memory TYPOS sorusu e aa A5-74 
A5.2  Coherency between data caches with the MOESI protocol ..........c:cccscesseeeeenteeees A5-75 
A5.3 Cache misses, unexpected cache hits, and speculative fetches „s... ceee A5-76 
ASA “DISADING ANCA CHIC 3; cocs5 aces ses aca cece esa a A5-77 
ASI- JInValidaling Or Cleaning a CaCl ete: ci se% sovestesct teat thers orice Atatiecleae teen Aes A5-78 
ASG Aboutread alloCate MOG sats: ssicshacesceisetorens otis tia t2tt ati ees tad Ae E A5-79 
AST 2x#ADOUE CACHE POLO CHOI sariren E A A5-80 
ASe =! (02) 1 0101110 19 -naea are erence rer ere tener emer or cee her tarerer teres fra Mere ARE A5-82 
AS: -Error injeClOn -seon a Ae Riakion Bie eA ee eras A5-83 
Chapter A6 L1 Memory System 
AGT AboüttheLT memory System icurersnesiin oaa A6-86 
G2. WEB ONGGIIZAON nerie e e a A6-87 
AGS Frogram ow ProdicUON n snis a a A6-88 
AG.4 “About the intemal exclusive MONMHOl x: 2:2) coriet oe cscetacs aaa aE A6-89 
A63 ADOUP Cala PIelOle MING eayoeseishciesotsctis teach AE R A6-91 
Chapter A7 L2 Memory System 
Ax ~AbDOULTHOAE? memory SV SIGN sioicsiscidssascsoncedsazsanesidene EAO A7-94 
A7:2  . SHOOP' ANd MAINICNANCE TEQUOSIS soroen irere inerea ir A EA aS A7-96 
ALD. -SUPPOM TOF memory WPOS isast oan a A7-97 
A7.4 Memory type information exported from the PrOC@SSOP „s.s.s ceteeennteeeenneeees A7-98 
Aro. -Handing otextema QWOMS csurran O A7-99 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 6 
reserved. 


Non-Confidential 





Chapter A8 AXI Master Interface 
A&1 About the AXI Master Int@rtae ic.ccccciossecsesvsncssicesvedovscees ariennir iian A8-102 
AGZ « AX! PAVIEGC:UNOMMALUON serasa nonan n A Ai A8-103 
AGS: AXUTIANSACHON Scscctecae.douecenicsiostensetanasbeeaastsastoniaaieraateendstunonssoyesdsaaieaisieseanoncecteerne A8-104 
A84 Attributes of the AX] master Inleriace -sssaaa ieena iiaiai A8-106 

Chapter A9 ACE Master Interface 
AST. About the ACE master INternacia ranna ce conensnsaesskeaouneces A9-110 
AQ:2 ACE configurations cinstendi d ara a ori ENE i esii A A9-111 
A93 -ACE pnvilegè Information -sssrinin aeniea eiea A9-112 
A94 ACE tränsactonS ssassn iieri n NNE E E EAEE EERENS A9-113 
A95 Attributes of the ACE master Int@laCe saurira A9-116 
ASG. Shoop Channel propries s scsissaiiisderdassurstecassvrascueieads E E A9-118 
AST- AX ecOMmPaANbIY MOI Eeoa EAEE AE A9-119 

Chapter A10 CHI Master Interface 
ATOT. -About the: CHLMaSterimernaCE sczcstz:csacsestesscsoeths eecssasseeusenecexesscechsasestdsacaseizd dese A10-122 
ATO:2 (CHI CONMQUIALONS vive. sus conenassttersdensiacecoren doesvansasatesbepravaccieivetveednesiteoseeedtassons A10-123 
ATO -Attributes‘of the CHI Master interface 2.:0céicsccvsscecceeoesssese-cdvececeeseuiesteecsseereeeesee A10-124 
A104 (CHI Channel PrOPCHieS:..cccvsocciieccossetietevdencs se ceasecterssncerstennsusssteecdstestoosseseeneseeed A10-126 
ATOS. (CHIUANSACHONS socics:seciccoctsnecs:aersceevecde stone sceraveneas env sngeddunensoeswerteteaqantenspaeeatiebossy A10-127 

Chapter A11 ACP Slave Interface 
ATII About MEAG sasssa eniri AEEA a EEr EEEE A11-132 
Alk MANSTGESIZE SUD POM cosis en eniT aa EA E E a E EARE A11-133 
ATS AGP POmOninanCe! seigir arai eea RE OPAS AERE A ERER A11-134 
ATA SACP USCFSIGMAIS onenian en aA AIEA EA EEA ARAE A11-135 

Chapter A12 GIC CPU Interface 
ATZI Bypassing the GIC CPU-InterlacE surtin E N A12-138 
A122 Memory map for the GIG CPU WMeOHace icsinvezccecneapzascetescteab E E EE A12-139 

Part B Register Descriptions 

Chapter B1 AArch32 system registers 
BiT: -AArcho2 Tegister SUMMANY sormr isian nra EA A R ee B1-146 
BIZ- “CONC GISECIS genein A E E ee B1-148 
BI: GTT ayeti E E ARE E B1-150 
BIA- SCZ TOGISECIS genetin A E E eee B1-151 
BIO: GZTEJISlEIS ornya ma E E E EE E E E B1-152 
BLG- CArOJ OTS irian e n a aeir a E E SEEE B1-153 
BIS “COCGISIOIS speir aa e A E A AS B1-154 
BIO: COTEJO osian e rna ERT EE DEEE E E a B1-155 
BRI CP MOGISIOIS odrana iena ENE E RE ENE E A B1-156 
B1:-10 -Gr SYSIONT operations seruare n i iaido B1-157 
B1:11 ¢8 system OPOlAUONS vsere TaN iiaii B1-159 
B112 CO TOGISECMS os ica csdesdesessucsteuvevaeree iendecondoravensesaiestiesendssttacedeoereessetes naesasensteesaceentonseds B1-161 
BITS CTO CGISIOlS seseorang E E EEEE B1-162 
BITA CTOS OS orria tion dead etd AO O EE OET deuaiaane eae T B1-163 
BITS CIZ HOGI SIONS: EEEE EE NO AEE N EE NEA B1-164 

ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 7 


reserved. 
Non-Confidential 








BILTG G19 registers  socsiss sauces as aegis hase n a A aeedaolenaweenies B1-166 
BIT? C14 TOQISLOMS: enson ee es ea ae a aes B1-167 
BILTE CT S:iCQISLOMS: sescsssnaessi se aipaedicalers pies cadh n a A ose eiaies B1-168 
B119  CFaD ITO GISUOIS xz ctencs2ieysa cas aicayss dt tiea ade Raa so a a a eae B1-169 
Bis20 -AArchS2ldeniticatiomnte gisters earr Genie me sR alee B1-170 
Bi.2t AArch32 Virtual memory Control registers sc: sisvesssscsstadevandoann n B1-171 
Biz22 AArch32 Fault handling registers oricare anna RR E A OEA B1-172 
B1:23 AAreh32 Other System contiol registers rorimrnanninne n n B1-173 
BI24 AArehoz Address registers cssennrasinn aan tab e A E test earioeese B1-174 
B1:25- AANCh32 Thread registos erenn e a E E EEEE B1-175 
B1:260. AArch32: Performance montor registers cc cescscscccsces cvesieondsece ar EERE B1-176 
BIZ? AANCHSZ Secure TOGISIOIS ssie E a E E E EA 

B128: -AArch32 VIMMAlIZANOMTCOISIONS despiei ER a EEA 

B129 -AArch3 2 GIC Syster rogi Stor S escais aiina arr a ra enda ena ea aaea en aa 

B1.30 AArch32 Generic Timer registers 

B1.31 AArch32 Implementation defined registers ........:.2s.:.ccencsseses csecnsescnserenesseesetecons B1-182 
BI.32 Auxillary Control ROGISIOM iisi.cciecsesencsceedenes scestoceseecvededboeecugeadersvieessvnsteecctienioseds B1-184 
B1.33 Auxillary Data: Fault Status Register sosisini seutccveeessesciteectbesetveeeees B1-186 
BI.34 «Auxillary ID ROGISICM srein nina a inaokoa B1-187 
B1.35 Auxiliary Instruction Fault Status Rēgister ssssesiiiisisieiiriiorisevneinvruorsrrirernnses B1-188 
B1.36 Auxiliary Memory Attribute Indirection Register Ou... ccs arransrisesriroiansera B1-189 
B1.37 Auxiliary Memory Attribute Indirection Register 1 .ssssseissssisisise cerinssrasesecnosansesi B1-190 
Bi.38 “Contiguratioh Base: Address Register sscriecisessenccsancsassdeedesse ae a AE B1-191 
BI-39 ‘Cache: SiZ6:1D ROJI SIO oeiia enes ann E R OA ny arcsins B1-192 
BIO Cache iLevel iD REgIStEr srie aaa B1-194 
B1.41 Architectural Feature Access Control Register siisiciseriseisiniine ceteteeeenneeeeeneeeeenee B1-196 
B142. -GPU Auxiliary Control Regter in izciecdssrcsasustnagsankesapceianied annaa B1-198 
B149 GPU Extended Control Register oisiirreiiiinsi nbi obierania B1-202 
B1.44 CPU Memory Error Syndrome Register aisiara aiara aak RERA B1-204 
B145: Cache Sizė Selection IROGISIOR orrira riara Eae A aa aaa EEE B1-207 
B146. Cache TPE ROCOISICR opiiarenrane iae E es ihareeteaans B1-209 
B147T DomamAccëss Control IRCGISUCR sorarsan a r a bias tes B1-211 
B1:48 Data Fault Address Registe srriiscneiissiikennerninioe annene i ea i B1-212 
B1:49 Data Fault Status Register ssircirsanisiireeesni ini aai B1-213 
B1.50 DFSR with Short-descriptor translation table format .........cccccccceee ceeeeteeeeneeenaees B1-214 
B1.51 DFSR with Long-descriptor translation table format .0.......:cccccccee ceeeeeeenneenennees B1-216 
Bi.52> Encoding of ISS/24:20] when HSRISTSO} iS ODO scisscscsssacs sceist tessa tated aatcaeas B1-218 
Bi.O3 FCSEPROESSID REJISSOR orinni rna a TE R O B1-219 
Bio4 Hyp-Aüxiliary Contiguravion Register ocnsmena megarna A ane B1-220 
BES9 Hyp AuUxINaly CONO REGISTON senina RAAR A A O B1-221 
B1.56 Hyp Auxiliary Data Fault Status Syndrome Register ........cccecesee ceeeeteeeeeneeeenes B1-223 
B1.57 Hyp Auxiliary Instruction Fault Status Syndrome Register „a...se B1-224 
B1.58 Hyp Auxiliary Memory Attribute Indirection Register 0 ....0...ccccececeeeneeceenteeene B1-225 
B1.59 Hyp Auxiliary Memory Attribute Indirection Register 1 ....0..ccccseccceeneeceenteeene B1-226 
B1.60 Hyp Architectural Feature: Trap Registr si.sc.ccs2s02:csaccceszseezev acisvecesonventenonsineseness B1-227 
B161; - FAY P!COMTQUTANON: RO GISION ironiseen a gussets ARE B1-230 
B162 bypiContiguiatiOn REGISIOR 2 rirse Riches teuisas aTa aa TiSi B1-236 
B163 Hyp Debug Control REGIO espaiosa ainia eran EARE RAR ARGE AE B1-238 
B1.64 Hyp Data Fault Address Register ssccciccisnsesecssscessiecteesetcersvessterevibeisdenstesestsesinoseds B1-241 
B1.65. -Hyp Instruction Fault Address Register sic: ccsocscivecvaesstcenees derien B1-242 

ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 8 
reserved. 


Non-Confidential 





B1.66 Hyp IPA Fault Address ReGISUCM isc ccs.cicceicocecdandedebe ceeded ote ccdeiesubuedaeie noniin B1-243 
B1.67 Hyp Systemi Control Register «icsc5..522cccescccenectenegeianieocanba ts cnbdesUicaieecdhtebedebedadaneecee B1-244 
B1.68 (AYP Syndrome Register sssrinin a a B1-248 
B1.69. Hyp System Trap Register saicsc2:ccccascosicieus cdeansioas andere i a a AR B1-249 
BI:-70- -Hyp translation: Control Register sarstisrnair io a ea E OA B1-252 
BITI. -Hyp Vector Base: Address ROGISLOD presioni nann an N B1-254 
BIT2 AUR aly Feature Register O 23:4 .sccaccemsisesncdasvnans A E A T B1-255 
BieT3 -Debug Feature Register Oaren anaa A A A cae eR B1-256 
Bis4 Instruction Set Aliibute Register O esseer aran E EE B1-258 
BI-795 -Instruction SetAttribute Register T sess ssaccceces aseran anra aiT E a E N B1-260 
B1:-76. Instruction Set Attribute Register 2 -esiri ira aaaea EE E EE B1-262 
Bis 7. lnstraction Set Attribute Register 3 -ssiinie ieran ae a E A E E B1-264 
B1.78.. Instruction Set Atribute ROGISIOR 4 sessista aid e ead aaa B1-266 
B179 Instruction Set AUHDUIC ROGISTCR Dereser ataa aie aeaeo dai anaa B1-268 
B1:80: Memory Model Feature Registr O scevcscsscesersesssonseuscteceba aaaeaii aaraa B1-270 
B181 Memory Model Feature REJIStOr Í c:sscszescsscssescodssesansacscutiridesescadaviecnsacserdsdeestinecsas B1-272 
B1.82 Memory Model Feature Register 2. ccncsieecuecatoctsevecvsessttendvevaderevivesvaensteecctbesvenseds B1-274 
B1.83 Memory Model Feature: Register 3 1.5 icc cscsecuecrsecstevecteessocectveoseprevinestdenevesecesorvenseds B1-276 
Bi.84 Processor Feature Register O siic. cist edvnse seivsscdvuestvndetites arru s rE EEE B1-278 
B1.85. Processor Feature Register T sccccccsscvereinesvcservescsvconsste pasire ioia B1-280 
BiL86. Jnstruction Faull AdGress:R OGISIOM ssisscscscecenssancesascenduesnaern a naa B1-282 
Biol instruction: Fault Status REGISlCM sii ssscacccteccsnscanediencsessavsinressaeeseieaenmascdessuassenaeidias B1-283 
B1.88 IFSR with Short-descriptor translation table format -isisusincisierisismerinesirsnna B1-284 
B1.89 IFSR with Long-descriptor translation table format ......0.::ccceeeee serrusssrnasssacssanas B1-285 
BIO) Interrupt Status REGISLON ipsctissscccszsacecnsecasspsapsetaaptseal niandespeties ize taatedonacsans ahepeieces B1-287 
BIOT .L2 Auxilian Control REGIStCl icszcz:c2cassés ia: secede sn ce tenaetaes casnecaeeasenigs toapeanacsanienanieines B1-289 
B192 LA Conto REJSE aies eT B1-291 
B199- L2 Extended Control REISEN siirsin T a B1-293 
B1.94 L2 Memory Error Syndkome Registar ..sc:ccicsccesestierctecestsane mnanaa iaraa ariaa B1-295 
B1.95 Memory Attribute Indirection Registers O and 1 .........::scs2scscseeesecccssertnecoonsenetense B1-298 
B196." Mam IDRE STOT rrie E e O bemtenetenes aetes B1-301 
BI97 ‘Multiprocessor Afinily FR OQISLOM s-mrnnaiea vided rana rA RES B1-303 
B1.98 Non-Secure Access Control Register «..c..ceccocssseccateccstuinte aiie n B1-305 
B1:.99 Normal Memory Remap: Register xi...0:.2ccs.cccccevecsnceve es sedevienedeedkceenenecdeeeconsoedeenes B1-307 
B1.100 ‘Physical Address Register .cc..ccse:ctacecscatccseas eceuncsspeeute seat viaa pie cdetocaea ees a B1-309 
B1.101 Primary Region Remap Register -.ocsss5-30secsree gui setered eiusbdcs Sesdodeecs ccendeceseteecdeaestuened B1-310 
B1102 REVISIONID REJIS ON aonana E E E A OAN O B1-313 
B1103 Reset Management ReOISIGl sisiiscsisan teenie n eink B1-314 
B1:104 Secure: Coniuguration REOISICN cernir eena AA vase seea asad onesie etoomean eel B1-316 
BIOS: System CONMOLREGISLOR seinninn r O O O OR B1-319 
B1:106 Secure Debug Control Register rrenricnior snee Rai B1-323 
B1:-107 Secure Debug Enable Register sireysriinie ia eE RER B1-325 
BIOS TOM Type Regter csiscazccicccssstesecdeccat bist t peti tetntaueeddesustesxugeead texgeisbecssnagueeseeeeeeees B1-326 
BIOS TEB: pe REISEN cele s ccs ohctis see e E cede ceansaeae vat elaxqntevies B1-327 
Bi170' Translation Table Base Control Register sccsicsscsssccessaonscesescac cena veesseiaedeesbenczceacase B1-328 
B1.111 TTBCR with Short-descriptor translation table format ...00.ccccesee cceneeeeeeeeeeee B1-329 
B1.112 TTBCR with Long-descriptor translation table format ...00.ccccccctee cetenteetetteeeeee B1-330 
Bitt2 Translation Table Base. Rogister O vecsecsesscsecestercs Mescaelivecesadieceasatdsemesssaradbidadibebeds B1-333 
B1.114 TTBRO with Short-descriptor translation table format .....0.ccccccciee ceeeteeeetteeeeeee B1-334 
B1.115 TTBRO with Long-descriptor translation table format ......0...cccccceceseeeeteeeeenteeene B1-336 

ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 9 

reserved. 


Non-Confidential 





Bi.176 Translation Table: Base Register T a.vs.c2ss2ctses sak seteoes fenstdes duvondeedodeaiedbieeetededeivectens B1-337 
B1.117 TTBR1 with Short-descriptor translation table format 0.0.0. ccccccie ceetteeeenteeeeee B1-338 
B1.118 TTBR1 with Long-descriptor translation table format ......0...cceceecteseeteeteereeene B1-340 
B1:119 Vector Base: Address Register sissien merione oinn aii iid i iaa B1-341 
B1:120 Virtualization: Müktiprocessor ID Register se:scigsscas. suis reenscaicdcacmisyersensieeacsentiayaeesuas B1-342 
B1:121. Vittualization: Frocessór ID ROGISICN ninni anii wegeest tas ra iaeaeLaeaceariai ee B1-343 
Bi22 Virtualization Translation Control IROGISICl ssss2icevasesussctesscaxterssaxaeceaesatiesgscamareevedes B1-344 
Chapter B2 AArch64 system registers 
B21- . AAnch64 register SUMMA srera ae e esac oes B2-350 
B22 AArch64 Identification TEGISLOMS :ciccc2.cccsessscescaeteecee canoes seetded ao aa B2-351 
B23 AArch64 Exception handling reQistels .: :.0s1.-icsecsseesucdervecsvie iiac B2-353 
B2.4 = AArch64 Virtual memory Control reQiSteLs ........0: eect tennis iiinis B2-354 
B2.5 AArch64 Other System Control rëgiSterS «.2.css.00.-ccdeieseeiesenden boone censeterciseousenbebeane B2-356 
B26 -AArch64 Cache. maintenance Operations isssicccscisaessensseeiesdeeaschcasasesua si anaa B2-357 
B27 AArch64 TLB maihtehance operations ieisscccisvaasdiesenc tines ar A ATEA B2-358 
B2:8 -AArch64 Address translation Operations ssimsmzrar merinin a B2-359 
B29- -AAreh64 Miscelaneos operatjoNS sprona a e R tant B2-360 
B2:10 AArch64 Performance montor registers sierounr nien aa B2-361 
B211: AARChO4F-RESCE rogstorS oranin E E E R EAEE B2-363 
B2:12 AARChOF Secure registers sssrin E E E A AEE B2-364 
B213. AAChOF Virtualization TOQISUOIRS: orisni E a E RE B2-365 
B2.14 AArch64 EL2 TLB maintenance Operations 2.2... cscccccssenecoecseceseczecncnsrecnscsensnstzcess B2-367 
B2195- -AAGCHO4 GIC SYSTC MITC GISIONS ecesna nia aN NEAT A E A ERENER RA B2-368 
B2:16: -AArch64 Generic: TIMSr registers seiscsecsestsececrsdsdeveestazesexetecnsassdeeesdedeiiuns czasoninessae? B2-370 
BATE -AArch62 Thread tegis tors ascii seed Hesecscetadunessacsoseseetisake cazesenteesbacedensetetiespesgeadsbeyeedt B2-371 
B2.18 AArch64 Implementation defined registers s..ccicescc-cicnsecesecceeee docdeeostteevinestieceveness B2-372 
B2.19 Auxillary Control Register ELT sssrinin tyner aani a rE EE B2-374 
B2:20 -Auxiliary Control Rëgistër EL2 wiccccccccovesienescaccncsesneerepeen tini ieri iinne niie rioei iiini B2-375 
B2.21 Auxiliary Control Register, ELS sisrsroridesmeisesednesionen teneo rieriidarndendioiriosirdvaiii B2-377 
B2.22 Auxiliary Fault Status Register 0, EL1, EL2, and EL3 uut.cccccseecee ceseesteeeeeeeeneees B2-379 
B2.23 Auxiliary Fault Status Register 1, EL1, EL2, and EL3 out. ccccesessee ceseesneeceeeneneees B2-380 
B224 “Auxillary ID REGIS tR EIT) rrenaren EE EA E ERR B2-381 
B2.25 Auxiliary Memory Attribute Indirection Register, EL1 ..sirsssissiisniaiciiinineisireseinnsas B2-382 
B2.26 Auxiliary Memory Attribute Indirection Register, EL2 s... neneeese B2-383 
B2.27 Auxiliary Memory Attribute Indirection Register, EL3 w......ce esses ceeeneeeeeneeeenaees B2-384 
B228 Configuration Base Address Register ELT uss. sirsiincssaceipinsaesz anes dasesnecssesssicestesets B2-385 
B229 (Cache:ssizeiD Register EL 1 -rescence oea estat aise a aae B2-386 
B230: Cache -bevelii0 Register EET errrreroimen a e a aoa B2-388 
B2.31 Architectural Feature Access Control Register, EL1 .......2.2::::ccccce cesseerecesenteaneees B2-390 
B2.32: . Architectural Feature. Trap Register, EL 2 sc .issxc.scstissiecsneiestibesisnsteeotiseesnecdiarsiterse B2-392 
B2:33° -Architectural Feature: Trap Register, ELD esirinnas aa B2-394 
B2.34 Cache Size Selection Register, EL ..........::sccccccscsccececseen ceeesnensnenesssessneesessessenee B2-396 
B235 Cache Type: Register, ELO sec sccscx. cet ocnses eatsades noia a ar eantaeeeaeeee B2-398 
B2.36 GPU Auxiliary Control Register, ELT sc.css.ccsccssgesieieerseieted ieoa B2-400 
B237 CPU Extended Control Register, ELT sscsssssssstencctvesssavesaleasa cieeadesieieetdinsnsateadeaes B2-404 
B2:38 CPU Memory Error Syndrome Registek ELT: sscsdssseisistansanssentevdiseantacimeoaiose B2-406 
B2.39. Domain Access Control Register EL? c.ccc.aiaiaeeniceen a B2-409 
B240 Data Cache Zero Register, ELO x. cssseescsageven desde cn an n tienes eeeeeanee B2-410 
B241. Exception syndroine Register ELI ssnsaaianak mice nadernet B2-411 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 10 


reserved. 
Non-Confidential 


B2:42 Exception Syndrome: Register, BL 2. -isitici anaiona ieia B2-413 





B2:43 Exception Syndrome: Register, ELS sisirin aoo i aaea eiaa B2-415 
B244 Faull Address Register, ELI sc.cscscssssexncsedssseasseaassvesessed oiin i n B2-417 
B245 Fault Address Register, EL2 icsssctesnstsaaeagssaassetass oerein wena seadnesed aed ened ead B2-418 
B246 Fault Address: Register EE 8 ise cccseesinadseasieatenienn ena a eens B2-419 
B247 Hyp Auxiliary Contiguration Registek EL 2 sicciiscssivsivadiasnaraisaivatencivtteaisieccenss B2-420 
B248: -Flypervisor Configuration Register EL 2 sisciesss sess tiitesspnsbatseaa waarmee maeeaiate B2-421 
B249 Hypervisor IPA Fault Address Register, EL2 ...ticccnsscssecnecoonsss ita B2-427 
B290- Hyp System Trap Register EE? ses gears tisnin E E EA N ER B2-428 
B251 -AArch64 Debug Feature Register O ELJ crre EERE E F B2-431 
B2.52 AArch64 Instruction Set Attribute Register 0, EL1 ........::ccccccssececeseeeeteceeseeneneees B2-433 
B2.53 AArch64 Memory Model Feature Register 0, EL ......cccccseccsescee ceseneteeneeesneeees B2-435 
B2.54 AArch64 Processor Feature Register 0, EL .......2.:c:ccccccssessesceceseeeesseenseneeseesnene B2-437 
B2:55 AArch32 Auxiliary Feature Register 0, ELT .ccccscsccssecsscsccesssecestcesseces cvsbecnaszeneszece B2-439 
B2.56: -AArch32 Debug Feature Register 0; ELD ssesscssccseesasvecssecesesetceteassnestacsbeczseacsandeesds B2-440 
B2.57 AArch32 Instruction Set Attribute Register 0, EL ........::cccccsccscescssseeeeeesessneaeeees B2-442 
B2.58 AArch32 Instruction Set Attribute Register 1, EL ........::ccccccsseceeceseserseeeeeeeneeeees B2-444 
B2.59 AArch32 Instruction Set Attribute Register 2, EL ........::cccccssssce cseseceeeeeseeneeeees B2-446 
B2.60 AArch32 Instruction Set Attribute Register 3, EL ........:.ccccccsseseceseeeeseceesetneeeees B2-448 
B2.61 AArch32 Instruction Set Attribute Register 4, EL .........cccccccssesee ceceseeseeeeseeneeeees B2-450 
B2.62 AArch32 Instruction Set Attribute Register 5, EL ........:.:ccccsscscecsssseeeeeesessenees B2-452 
B2.63 AArch32 Memory Model Feature Register 0, ELT ..ccccsecscsccncscoonss ccsotsecesonessssennoes B2-454 
B2.64 AArch32 Memory Model Feature Register 1, ELT ...cc.sscscsctncccoorss cosotescseonessesensoes B2-456 
B2.65 AArch32 Memory Model Feature Register 2, ELT ...cccsccccsccncscoonss coseteeeessnnesssennoes B2-458 
B2.66 AArch32 Memory Model Feature Register 3, ELT ccicscccsssscstssocssnasseneestacetertetaeess B2-460 
B2.67 AArch32 Processor Feature Register 0, EL ........:::::cccccssssseececesneesesssenseeteseeesenee B2-462 
B2.68 AArch32 Processor Feature Register 1, EL .....2..2::::cccccsssseeccecesneetenseensesseseessenee B2-463 
B2.69 instruction Fault Status Register: BLD receio naea aia B2-465 
B2.70 IFSR32_EL2 with Short-descriptor translation table format .......c:cccee cece B2-466 
B2.71 IFSR32_EL2 with Long-descriptor translation table format ........cc cee ceeeeteeeeeeees B2-467 
BATZ Inlemupe Stas: REGISIOi ELI sso cecs2 stent etcestt n a a teatlnietetaaeetnathte B2-469 
B2 73: 2 Auxiliary(Gontrol REJSIE EET cerien E A a B2-470 
B274 L2 Control Register ELI sss: eiiieaen oreina sade ieee B2-472 
B279 L2 Extended Control Registor, ELT arerin oiei a eA B2-474 
B2:76 L2:Memory Error Syndrome Register ELT ..ccceccssccsissisiisecs celeeceseenctonnssviceedecds B2-476 
B277 Memory Atinbute indirection Reəègister, ELT ...ccciessscvsscseieties 02 aiceieotesistessoesiendeces B2-479 
B278 Memory Attribute indirection Register EL2 c.cciccssdssenssteassare one annainn B2-481 
B279 Memory Attribute indirection Register, ELS ciciisctersescosssunsiasde aiaei ii B2-482 
B2.80. Monitor Debug Configuration Register EL2 sesscsmenemnennnioe tanana B2-483 
B2.81 Momtor Debug Configuration Register ELS enarssamemannedunsan naaa B2-486 
B2.82 -Monitor Debug System Control Registern ELJ sernir nriran B2-489 
B283 Main ID) Register ELT serere iE a EEE e AEF B2-492 
B2:84- Multipröcessor Affinity Register ELI -sintieran a a EREET B2-494 
B2895 Physical Address: Register BLT scczsieuiturme i R B2-496 
B286: JROVISIOMID REGISIOI ELJ creisis aranin Aei a enS E ERNEA B2-499 
B287 - Reset Management Register EL 3 sresti oen naa Sanni ae aag B2-500 
B2.88 Reset Vector Base Address Register, EL3 o0....1.c.cccccsccscececesenneeeeeseeennentesseenseneeens B2-502 
B289 Séctire Configuration Register JEL ssiri seabescdssesonazscateieacedensssersouisaiancs B2-503 
B290 System Control Register ELT sorserion iaiia B2-506 
B291 System Control Register EL2 siecia iia iaiia B2-510 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 11 
reserved. 


Non-Confidential 


B292: System Control Register ELS oarenien a need aaa aE B2-512 








B293 Secure Debug Enable Register, ELS -snenie oa B2-514 
B294 Translation Control Register, (ELT isi.csessscaseccsasseasesneasedanse ianen orena ia B2-515 
B295 Translation Control Register El 2.5.2 sisssasscesasseesepeaas easton a ai aaa iaaa B2-519 
B296 ‘Translation Control Register ELS: rrira aies a ean ena B2-521 
B2 97 . Translation Table Base Register 0). ELI sivscssasss tons earensaneaan nade ead aes B2-523 
B298 Translation fable Base: Register 1, ELT sncsnnndustieaniatieni mai ees B2-524 
B2.99 Translation Table Base Register 0) ELS ssscasiasccscessceaeeeavese ap teazsin ads cdssasadvensacaies B2-525 
B2:100 Vector Base Address Rəgister ELI asicsciceiatiisecsaastaviennstateseeaesaiadiasaxaseeetacaaaiadiees B2-526 
B2:107 Vector Base Address Register EL2 srissuenise ie E E E B2-527 
B2102. Vector Base Address Register ELI sarreria e e e e E B2-528 
B2:103 Virtualization Multiprocessor ID Reëgister, BIZ i oscciecorcseezcesenouee severe cecesancdecmredades B2-529 
B2:104 Virtualization Processor ID Register ELZ a iiecesssacsnedsdcacescnteads aeacubssesedssesaeteeiodiaes B2-530 
B2.105 Virtualization Translation Control Register, EL2 ........1.::ccccccscsseecsenseeeeesnnteeeeeeenens B2-531 
Chapter B3 GIC registers 
Bat. OPUnteraceregister SUMMA orscsmnanrir iin sei asda ATO B3-534 
B32 Acie PHONY REJI IEF ernie A E N TANE B3-535 
B33- CPU Interface Identification REGISICR 22. wccecscssaza2eatssnes aaee a a A B3-536 
B34  Viitualinterface Control register Summary sodis sssstiresia nane ine B3-537 
B395 ‘VGI Type Register rrn A E a RE E EE B3-538 
B36. Virtual GPU interfaceregister SUMINGNY soisista piiniera ia iE RE B3-539 
Bail "VMA PHONY REGISTO sardrin ana a ea aae B3-540 
B3:8 VM CPU Interface Identification Register .......c2::csssenecsessseseocctessenenseosttesecesostiness B3-541 
Chapter B4 Generic Timer registers 
B4.1 Gehène Timer register Summa sesesstes: siracscar anaE A O B4-544 
B42.  AArch32 Generic: Timer register SUMMALY ustasini riesite EEEIEE a E ARRE B4-545 
B43  AArch64 Generic Timer register SUMIMALY snssirssiessperiscisiseirsinedunersiisre teuint B4-546 
Part C Debug 
Chapter C1 Debug 
Cid -ADoutdebug IMG OOS srsorniinnra a n a AOA A TE C1-550 
C12: DebujaAcCoS Sus E E east C1-551 
C13. ‘Effects: of resets On debug registers iicccniccacinciveseazevesnsiside destectiesseti E R E C1-552 
C1.4. External access permissions to debug registers cusrom aieeaii C1-553 
CLS * DOD UG OV GIS -reres i E AEE 
C1.6 Debug memory map 
CUP, WODUG SIgnalSis eseese an n E AAR sa ceetssetzsa EE 
C1.8 Changing the authentication signals for debug --.::1-:1::1111111121115 cette ceenteeenneeeeenees C1-558 
Chapter C2 PMU 
GAT “ADOUT MERMO sirrien a EE OAREN O U E O AG C2-560 
C2.2 External register access permissions to the PMU registers ..........cccccceeeeeeeee C2-561 
C23). Performance monitornng Events serrirscdarar nAn E a EARR C2-562 
C24-  PMUDIMCIE DES ieser e ie E E ees C2-566 
G25 Bponng PMU evente sieer iee e E a RE C2-567 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 12 


reserved. 
Non-Confidential 


Chapter C3 ETM 





CBT. Abouttho ETM eccsszezsccciuassecceheedesaesetceiiebsbesaetused idavdercgeddoesegoedv EE E C3-570 
C3.2 Configuration options for the ETM unit and trace resources ...........2160 ceeeeeeeeeee C3-572 
CBS ReESotng IPO ETM ssctetetdsnssinceiancinsstentesawasieedecasaetieysivagssiuasiuinlecarasuant avant ectetetas: C3-574 
C3.4 Programming and reading ETM trace unit registers s.sissiserisssiosisorinisecsresini C3-575 
Chapter C4 CTI 
CAT AADOUEITEICIOSS=TNGOON saires aia ap aar raa C4-578 
C42 Cross-triggerinpütsand OUTPUTS oi ic.scseccccecossacereedeateticets covedecsteesooeedeebiogss oes vaees? C4-579 
Chapter C5 Direct access to internal memory 
CS. -Aboutdirect access 10 Internal MMGMONY, ycrerre inea E suede C5-582 
C5.2 Encoding for tag and data in the L1 instruction CACHE uu..... eee eeeetececeenteeeneeeeeeee C5-583 
C5.3: Encoding fortag and datan the LT data cacheront C5-584 
C54 JlEncoding:ior theviniain TEB RAM scaireanna raaa ARRE aa aeai Geena’ C5-586 
G35 Encodmg Tor WAK CACNO sssaaa ea aiee NARTA EaR C5-591 
G36- JEMCOGING TON IPA CICNE airiran a EEE E ERTA aiai C5-592 
Chapter C6 AArch32 debug registers 
C61 -AArcho2 debug register SUMMA oner i a RE C6-594 
G6:2° Debug Breakpoint Control Registers n iiemesiie e E ETR C6-596 
C63. Debug Watchpoint Control Registers nsrrinriiisene iiaea EERE C6-599 
GOA.  DebugID REGISIOM porran aaie e e A C6-601 
CES. -DebUGIDAVICS IDUREOISIGicsesasccsneisideuss ce lestesdvestesistelatacsidteadsdizsessezancesssacecaset deuce C6-603 
C66 Debúug Devic ID REJISOF Í seascsiedsseexcseststes vests iozdetclanletesPaendzataes3eadsreadehesbandeesece C6-605 
Chapter C7 AArch64 debug registers 
C7.1  ~AAKCh64 debug register SUMMA osstssiesserecs sadetis ceca E A C7-608 
C7-2 ‘Debug Breakpoint Control Registers; ELT iiss. cueiniianh cesarean C7-610 
G3 ` Debug Watchpoint Control Registers; ELT seseris ioen iaia C7-613 
Chapter C8 Memory-mapped debug registers 
C8.1 Memory-mapped debug register Summary iissrisiiisiueimie siertuinen C8-616 
C8.2: External Debug Reserve Control Register simissioiiisiiiiiiiioasiee niniin ne C8-620 
C8.3 External Debug Integration Mode Control Register .......2..::c-ccccseeccsseceseeeoneeneeees C8-621 
C864- External Debug Device: ID Register 0 ictisnstnucmiaceneat nineteen nee C8-622 
C&8.5 ‘External:Debug Device ID Register T sisctsssssscevaatancesancduacsd or AA i C8-623 
C86- External Debug Processor Feature: Registe o.1.2.sccsscccceseosecesecosesesnssseeeecoontenne cess C8-624 
Gey -External Debug Feature Register sraciioenr iir acecbiectees tack EERE C8-626 
C8:8 External Debug Peripheral Identification Registers srsisssiroion annarai C8-628 
C8.9 External Debug Peripheral Identification Register O. sissies inersia C8-629 
C8.10 External Debug Peripheral Identification Register 1 ririsiseizsiu sirere C8-630 
C8.11 External Debug Peripheral Identification Register 2 00. ...cccccesccee eeteeenteeeeneeeee C8-631 
C8.12 External Debug Peripheral Identification Register 3 ......eeccccscces eeteeenteeeeneeee C8-632 
C8.13 External Debug Peripheral Identification Register 4.00. ...cccccsccee ceteenteeeeneeeee C8-633 
C8.14 External Debug Peripheral Identification Register 5-7 ......ciccceccccenteeeeettenenes C8-634 
C8.15 External Debug Component Identification Registers ........0:ceecceseeceeenteetnetenenneee C8-635 
C8.16 External Debug Component Identification Register O u......ccccee ceeeeeneteenennees C8-636 
C8.17 External Debug Component Identification Register 1 ......:ccceee ceeeeeneteeeennees C8-637 
C8.18 External Debug Component Identification Register 2 sisisssissisisr sriiserisrersorisn C8-638 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 13 
reserved. 


Non-Confidential 





C8.19 External Debug Component Identification Register 3 .......ecceeee ceeeeeneeeeennees C8-639 
Chapter C9 ROM table 
COT: -AROULTIOC ROM fable nanne ines taies desea setiezcet ia cpsae es tags teke lass ec secede C9-642 
C92: IROM table register lem ace: iciaee uastatisdie st ionias C9-643 
C939 JROM table neGister Sumnar sicip sacccs tine sdssccecesecas tess secaleseetaetast o aa C9-644 
COA: ROM omiy rEgStOrS hiss at cscs so ters sakes Mckee i ech atid ated sate E ates eethiee a C9-645 
C9.5 ROM Table Peripheral Identification Registers ..........:c:20:sccs00 cnecssonetneesensntenees® C9-648 
C9.6 ROM Table Peripheral Identification Register 0 .........::::sccc0s:sccecceosncsssneenneossnecses C9-649 
C9.7 ROM Table Peripheral Identification Register 1 .........:::sccssssccecesosnesssnennneosenneses C9-650 
C9.8 ROM Table Peripheral Identification Register 2 ossiirieiiiisir niren C9-651 
C9.9 ROM Table Peripheral Identification Register 3 .......1.....:scccscccecesseneerenseeeesceenens C9-652 
C9.10 ROM Table Peripheral Identification Register 4 o......ccccsseceeeceeeeenneeeenteeeenneenens C9-653 
C9.11 ROM Table Peripheral Identification Register 5-7 .......ccccccccescee seeecesteeeeneeenenees C9-654 
C9.12 ROM Table Component Identification Registers ......4...s:scccsssscee cencsessceceeonseneeens C9-655 
C9.13 ROM Table Component Identification Register 0 ........1::cccssccsssscinesoonsseeeonesnssenees C9-656 
C9.14 ROM Table Component Identification Register 1 ........::ccccsccccsssccerseceeeneneeeeneees C9-657 
C9.15 ROM Table Component Identification ReQiSter 2 sorarsan C9-658 
C9.16 ROM Table Component Identification Register 3 .........::cccscccsssccersnesereneesennees C9-659 
Chapter C10 PMU registers 
G10:1. AArch32 PMU register summary siisii oenina aa C10-662 
G10:2 Performance Monitors Control Register osissrseiiiierieiriaiiiienirnaroan C10-664 
C10.3 Performance Monitors Common Event Identification Register 0 ........00. cee C10-667 
C10.4 Performance Monitors Common Event Identification Register 1 a.a.. cee C10-671 
C105 AArcn64 PMU register summa sizsssusecseadsdusesanceiny ofasecabseseecteea Ra C10-673 
C10.6 Performance Monitors Control Register, ELO ..........:::cccccccsccc: seeseseeeseenseneeeneens C10-674 
C10.7 Performance Monitors Common Event Identification Register 0, ELO.............. C10-677 
C10.8 Performance Monitors Common Event Identification Register 1, ELO.............. C10-681 
C10:9 Memory-mapped PMU register Summary -2.0.ccse.nsetescasecuereateimessenseecactenronteeexseree C10-683 
C10.10 Performance Monitors Configuration Register ..........: cesses neesneteeeenneeeeeneees C10-686 
C10.11 Performance Monitors Peripheral Identification Registers „n... C10-687 
C10.12 Performance Monitors Peripheral Identification Register 0 ........cccceceseeeeees C10-688 
C10.13 Performance Monitors Peripheral Identification Register 1 s.is seess C10-689 
C10.14 Performance Monitors Peripheral Identification Register 2 a...se ceee C10-690 
C10.15 Performance Monitors Peripheral Identification Register 3 as...as cesses C10-691 
C10.16 Performance Monitors Peripheral Identification Register 4 ........ccceceseeeeeeee C10-692 
C10.17 Performance Monitors Peripheral Identification Register 5-7 0.0.0.0. cece C10-693 
C10.18 Performance Monitors Component Identification Registers .........:ceeee eee C10-694 
C10.19 Performance Monitors Component Identification Register 0 a...se cee C10-695 
C10.20 Performance Monitors Component Identification Register 1 a...se cee C10-696 
C10.21 Performance Monitors Component Identification Register 2.0.00... cee C10-697 
C10.22 Performance Monitors Component Identification Register 3.0.00... cee C10-698 
Chapter C11 ETM registers 
C111 ETM register SUMIMANY sisiscesiessostecaverssect cscs vaeeds tenesabdedosensesendorseuessdeceteeoadssatooserye C11-701 
C11.2 Programming Control Register sc.ssccoeccevceseeconccuedeveoesvnesetcereacsenesvousedbycadoroszurdvenes’ C11-704 
C113: Status ROGISIOR emessi ronin E ROEE rE EOR C11-705 
C11:4 Trace Configuration Registër 3.15 csecsiccsvidesscestcnsssoe vesseee ciasno iiia C11-706 
Cilio. . Branch Broadcast Control REGISICR ranae eiia A EA C11-708 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 14 
reserved. 


Non-Confidential 


ēC11.6 -Auxiliary Control REGISIOM -2csssecicsecssdtarsenes cota weed enbieWih of a aai C11-709 





GI1.7 Event Control 0 ROGISt Or seccnosssinenii sess eauts eduast sola a Weaneeaeyeeeté C11-711 
G11:8: Event Control 1 Registr s:23..-2teictcnnsceie race oneca in eee C11-713 
C11:9 Stall Control -ReGISIOF os.sciscss cote ese atten ec eases C11-714 
C11:10 (Global Timestamp Control REJIS erea anaa a C11-715 
C1111. SynéhroNization Penod REJIStOF narini a E E E C11-716 
C1112 Cycle Count Controle Gister osineen a EA E A E C11-717 
CUT Tace IO REGSE verse E E eine nea C11-718 
C1114 Viewnst Main Control ROGISION as: coxscreciscessesieztian nn E E EEE C11-719 
C11:15. Viewinst Include-Exclude Control Register ssrirrinsenirna diiint init C11-721 
C11.16 Viewlnst Start-Stop Control Register sirce EREE C11-722 
C11.17 Sequencer State Transition Control Registers 0-2 psrsssso erene erisrssanein C11-723 
Cie Séquencer Reset Control Regista szicc:ceccsstecceecesciessedeneecstsieitnessatsuveeesbacsbivecees C11-725 
CII% SGQUCNCEF Stale |REGISION siseses intir Aa EEE DTE EEE EET EEEn ai C11-726 
CIT 20 External Input Select ROJI STOF idris Enia AA REE C11-727 
G17:27_ Counter Reload Vale: Registers O T ss iczescsseccesceenseviecoecstehcacsusteesndecdesbedacentebebans C11-728 
C11.22 Counter Control Register O operni wavtcadenstenteesstorsversvaveeteaccee C11-729 
611.293 ‘Counter Control Register T x.ci.iscseciecssessocnsevaesests sconces aeniei EAEE roai C11-730 
C11.24 Counter Value: Registers OFT sscisiietiiecesceessncearieecogatere-aitecedodeegegeateruiieesevevtiee cies C11-732 
C1125: ID REGISION Gs. iessa00ccercece ss beciateasaseteceyescnqsvesve-cineiesasecleasaqueieesieeuessesnieeaenteanteits C11-733 
CTL226 ND REGISICM O iasctandesssasaaes saat a ENA E EE C11-734 
CLT ND ROGISIOR TO sascssaxtesdasaaesstaesacasseaistiacsaaissesobie E ENTE E EEE C11-735 
CURLS: ND REGISIOR IT ciswastiesesascesixtectioxusalsaaeinnsseaerasnantatesenatesd ELEA EAE C11-736 
CUL29 WD REJI NEF V2 nores eian aa E T O ebasctenesanaes C11-737 
CHZOID RƏgister TI sisteucssceis coke sitecaiceue oea C11-738 
C1131 Implementation Specie Register O inipon tie ptassaccadasecaeeselbiegiainyelds C11-739 
CH2 IO IREGISTCH O's sasainn Oin aE a EESE C11-740 
CMS SADRI Tysnes C11-742 
CUBA: WD TROOISTC 2 em a a a a e a C11-743 
GIS DREG kc) (ke pee eee met er renee eet a ere aera ore Serre eer renee rere gece tere ee er C11-744 
CTT BO DRO OISIC I T oiin nas eh aba asta Shireen bas a ie tase a aaa dea C11-746 
ONT (DREJTO D arene ere ner e ore eer ree Peete pre reet rer err renee reer ree C11-747 
G11.38 Resource Selection Control Registers 2-16 ercicsson aa C11-749 
C11.39 Single-Shot Comparator Control ReQisSter Q 0... eeccceseeeteecesneeeeeeeeeenneeeneeees C11-750 
C11.40 Single-Shot Comparator Status Register Ou... ccceeeesteee senteeeeeteeeetneeeeeneees C11-751 
G11.47 ‘OS Lock AGCOSS REGISIO? sso. casionscaectcconde tastvie nego de otte' eiia A os C11-752 
CITAZ: OS EOCK Stall SIRO QISIGN 255 siaheys ccsauasiuseseniad n E A tagae an bhava O O C11-753 
CITAS: Power Down Control IRCGISLOF sretna an E aE nas tigen bie gaess ae eaten aes C11-754 
C1144. Power Down: Status Regter js :cectessiascescnsseried vasceasaeinus sats sete na eae C11-755 
C11.45 Address Comparator Value Registers 0-7 ....cc.ssccccescsesseecesed venenesedscrvesenssstecnees® C11-756 
C11.46 Address Comparator Access Type Registers 0-7 o0....eecesecceceste seeeeeeneeeteneeeee C11-757 
Gil4/ Context ID Comparator Value Register O ici: sascuscccsgestecantexestensseverseocktscuetreeeeears C11-759 
C1148 VMID Comparator Value-Register Oli: sisicnccgs poe renren in R C11-760 
G11.49: Context ID’ Comparator Control Register O ores scccascccesencucsusstes iaeia C11-761 
C17.50' Integration ATB Identification Register scscicsssce3cseess002 cxsevenas ass s2cnerececaevecnsecensersees C11-762 
C11.51 Integration Instruction ATB Data Registar .......::.c..2000:cssecnese: aessesnceniasecsoosstnsoonee C11-763 
€17.52 Integration Instruction ATB In: REGISUGM sicsissazcesseoescsdescassszesnsacssvessesassizeesceoestnanbes C11-764 
C17.53' Integration Instruction ATB Out Registo. siisctscecesssescss2cscesace2 annarrar C11-765 
G11.54 Integration Mode Control Register -..0s..:csesscvesvasssviecdenscatinssoecerivneedvedtcensestervesceeds C11-766 
C1155 ‘Claim Tag SOUR GIS(OF sensira niae EENEN eN C11-767 

ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 15 

reserved. 


Non-Confidential 





G11:56 Claim Tag Clear Register .cceccez.-2cses ces pioceiesdseiandeds aucune Wecenae a e E C11-768 
G11:57 (Device Alfinily Register O ciiicc2ccccccceeseceiiencsdeabs onnon ena a Aa C11-769 
G11:58 ‘Device Affinity Register Í cisc.-2sesecveeese2ciesaevaseai tots cob sanndelneceeesebie ai C11-771 
G11.59 Software: Lock Access Regist. sisirin neraet iiiaio C11-772 
C1160 Sotware Lock Status REJSO ssiie: sieisistiaeasceigur arate E C11-773 
C1167 Authentication Status Regilor sisciasaregssecdisaaascatacanais Hestariacuias O tesa C11-774 
C1162 Device Architecture Registar s.as.c14 sasactassetianssanaiacmnne TA OTAN C11-775 
CIT 63 ADO VICE ID REGISTO an n a E D O A O TE C11-776 
C1164 Device Type Register srren ne E E NE C11-777 
6171.65 -ETM Penpheral Identification RegISterS sseni ns ain Ea e Ra C11-778 
11:66 ETM Peripheral Identification Register O srrnersiressieris oani uae eaa C11-779 
611.67 -ETM Penpheral Identification Register T ss2iccescart cases veapcescevnns aoe iereeceneanssearvxcaeeae’ C11-780 
C11.68 ETM Peripheral Identification Register 2 .s.1.:.22:0:cscscc..seccece: aescnensenesvecenessaveneosss C11-781 
C11.69 ETM Peripheral Identification ReQISt6r 3 aeeiiaii aoi aaa C11-782 
C11.70 ETM Peripheral Identification Register 4 .....2..2...cssncssssseccsos sestneestacernconsssseeneeses C11-783 
C11.71 ETM Peripheral Identification Register 5-7 .....:.2.::c0csccssensses senseccssesnessnocntencess C11-784 
G11.72 ETM Component Identification ROGISICMS «. ccccs:cccicssssecvesentsatnersenecuvacetersecvrevnee’ C11-785 
G11.73 ETM Component Identification Register O svsecivcsccvesccecsesoeseeee oraninin C11-786 
G11.74 ETM Component Identification Register T ssiru C11-787 
G11.75 ETM Component Identification Register 2 sinisesse densnseorteenseceosaveednes® C11-788 
C11.76 ETM Component Identification Register 3 sssscscdvsscssanessexcsnisd eaisadeostedteenssaunscensse C11-789 
Chapter C12 CTI registers 

C121. Cross TIGGER EGISIOMSUMIMANY. rasiri eiriaa Ta a SLAR C12-792 
C12.2 External register access permissions to the CTI registers s.is: r111rr11riiass0a C12-794 
C123 CT Dëvieeldenincaton REGISTON szzsiscssescescessteotheseecacss ga ai iea aS ARES C12-795 
C12.4 CTI integration Mode Control Register ....0:sccccseseeccconsodeect arininn C12-796 
C125 CTI Peripheral Identification Registers ossessioni drieen C12-797 
C12.6 CTI Peripheral Identification: Register 0). scciciecccccoseecicocssee ecko stentieeodeecetonsedsectconsed C12-798 
C12.7 CTI Peripheral Identification: Register T sccisiscciecosecextonsseeccte renien C12-799 
C128 CT Penpheral Identification REJIStor 2 arenario aE C12-800 
C129. ‘Cri Penpheral identiiicaonm ReGIster 3 renere RA aE C12-801 
C12.10 (CTI Penpheral Identification REGIStCF’ 4. sccosesevassuaessvenensbesesssssereseunessiuncsvassereeses C12-802 
C12.17 ‘CTl Peripheral Identification Registar 5-7 rrisnin oiera RE C12-803 
C1212 CTI Component Identification REGISICIS sicie irat C12-804 
©1213 CTI Component Identification Register O ¢2:2255:2-sseszecescesetancaanaedapactesapaeeszexcconses C12-805 
C12-14 GT Component identification RÈgISter T sririsipipiiiserestaaaian ipone seteia C12-806 
©1219 CGU Component identification: RƏgISter 2 .:s:22..:cssseszssassitesspcaacadapetesapsecczsxecaeses C12-807 
612-16 CT Component Identification Register 3 cornme ar C12-808 

Part D Appendices 

Appendix A Signal Descriptions 

A.1 About the-signal GESCIPUONS ernie pnnneien e aaa Appx-A-812 
A.2 Processor CONMGUIALION: SIGMAlS sarsan aiai Appx-A-813 
A.3 COCK SONAS ore iar e r r eater Appx-A-814 
A.4 RESOL SIQM Al osani rea a a a R ce heels Appx-A-815 
A.5 UG SSG INS scarce iaa oats E See bates eas ac han 8s vobeae gs eacescaey et Appx-A-816 
A.6 (GOMONG THING SIQM AIS aac hextsustt detec cays Uiecande sdb E S Appx-A-819 
A.7 Power management SiQMAIS: inon nocsstbsetiessedeselae seeded aandedeseveuoasdvotinem venues Appx-A-820 

ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 16 

reserved. 


Non-Confidential 





A.8 LEZ ONIOP SIGMANS saa -sasestiss crest ess Hind a a ATE Appx-A-822 
A.9 ACP InleraGe: SIQMAIS osien e ea o iR Appx-A-823 
A.10 Broadcast signals for the memory INOMTACE sssiiiroiiannirininrenisaaa Appx-A-825 
Alt AXi interlace: signals cccream dA NA ees Appx-A-826 
A12 -ACB interface: signal aaa a R ERR O R Appx-A-828 
Arla?  (CHMIMNGHACE SIGNAS sciccrastosscaisevinnt satire eied meaner aLa mr eed Appx-A-832 
Aste. WDGDUG SION AIS cisccsisdvapssaccerascsaetaasads sean tea nantes aha asia waive as eateeaanraeanea aan Appx-A-835 
Ato, “APBUNICHACCISIQN GIS cscs sasirndssseon NE O aide Appx-A-837 
ANG: : ATB mterace signals onreine E E G Appx-A-838 
A EIM SONIS wis cc reser cate g eed 05h E E T ech eoeteeeeees Appx-A-839 
AAS IPIMUOIMCMAGCO Signals eraai E E Appx-A-840 
ATS . CTintenace signal yesica e e E E Appx-A-841 
A20- TT ARO ACS SIINA S sasae a a a a Appx-A-842 
A21 MBIST menac™ SONAS cesson ko Ee o T E Appx-A-843 
Appendix B AArch32 UNPREDICTABLE Behaviors 
B.1 USE O RI SIDY INSUUCHON earo na eA A alae eae eae Appx-B-846 
B.2 UNPREDICTABLE instructions within an IT BIOCK cearminsecrionienanai Appx-B-847 
B.3 Load/Store accesses Crossing page DOUNAALICS 0.0... eececeee preunit Appx-B-848 
B.4 ARMv8 Debug UNPREDICTABLE behaviors .00......::ccceeeceeeeneeteeenneeeeeneeennaee Appx-B-849 
BS Other UNPREDICTABLE DON AVIOIS: risene nE E E ERT RRE Appx-B-853 
Appendix C Revisions 
C.1 REVISION S na E A E E N O easier meee Appx-C-856 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 17 
reserved. 


Non-Confidential 


Preface 


This preface introduces the ARM” Cortex®-A35 Processor Technical Reference Manual. 


It contains the following: 


¢ About this book on page 20. 
e Feedback on page 24. 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 
reserved. 
Non-Confidential 


19 


Preface 
Product revision status 


About this book 


This Technical Reference Manual is for the Cortex"-A35 processor. It provides reference documentation 
and contains programming details for registers. It also describes the memory system, the caches, the 
interrupts, and the debug features. 


Product revision status 


The rmpn identifier indicates the revision status of the product described in this book, for example, r1p2, 
where: 

rm Identifies the major revision of the product, for example, r1. 

pn Identifies the minor revision or modification status of the product, for example, p2. 


Intended audience 


This manual is written for system designers, system integrators, and programmers who are designing or 
programming a System-on-Chip (SoC) that uses the Cortex*-A35 processor. 


Using this book 
This book is organized into the following chapters: 


Part A Functional Description 
This part describes the main functionality of the Cortex-A35 processor. 


Chapter A1 Introduction 
This chapter provides an overview of the Cortex-A35 processor and its features. 


Chapter A2 Technical Overview 
This chapter describes the structure of the Cortex-A35 processor. 


Chapter A3 Clocks, Resets, and Input Synchronization 
This chapter describes the clocks of the Cortex-A35 processor. It also describes the reset options. 


Chapter A4 Power Management 
This chapter describes the power domains and the power modes in the Cortex-A35 processor. 


Chapter A5 Cache Behavior and Cache Protection 
This chapter describes the CPU and SCU cache protection features of the Cortex-A35 processor. 


Chapter A6 L1 Memory System 
This chapter describes the L1 instruction cache and data cache. 


Chapter A7 L2 Memory System 
This chapter describes the L2 memory system and the Snoop Control Unit (SCU) that is tightly 
integrated with it. 


Chapter A8 AXI Master Interface 
This chapter describes the AXI master memory interface. 


Chapter A9 ACE Master Interface 
This chapter describes the ACE master interface. 


Chapter A10 CHI Master Interface 
This chapter describes the CHI master memory interface. 


Chapter A11 ACP Slave Interface 
This chapter describes the ACP slave interface. 


Chapter A12 GIC CPU Interface 
This chapter describes the Generic Interrupt Controller (GIC) CPU interface of the processor. 


Part B Register Descriptions 
This part describes the non-debug registers of the Cortex-A35 processor. 
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Chapter B1 AArch32 system registers 
This chapter describes the system registers in the AArch32 state. 


Chapter B2 AArch64 system registers 
This chapter describes the system registers in the AArch64 state. 


Chapter B3 GIC registers 
This chapter describes the GIC registers. 


Chapter B4 Generic Timer registers 
This chapter describes the Generic Timer registers. 


Part C Debug 
This part describes the debug functionality and registers of the Cortex-A35 processor. 


Chapter C1 Debug 
This chapter describes the debug features of the processor. 


Chapter C2 PMU 
This chapter describes the Performance Monitor Unit (PMU) of the processor. 


Chapter C3 ETM 
This chapter describes the Embedded Trace Macrocell (ETM) of the processor. 


Chapter C4 CTI 
This chapter describes the cross-trigger components of the processor. 


Chapter C5 Direct access to internal memory 
This chapter describes the direct access to internal memory that caches and TLBs use. 


Chapter C6 AArch32 debug registers 
This chapter describes the debug registers in the AArch32 execution state and shows examples of 
how to use them. 


Chapter C7 AArch64 debug registers 
This chapter describes the debug registers in the AArch64 execution state and shows examples of 
how to use them. 


Chapter C8 Memory-mapped debug registers 
This chapter describes the debug memory-mapped registers and shows examples of how to use 
them. 


Chapter C9 ROM table 
This chapter describes the ROM table that debuggers can use to determine which components are 
implemented. It also describes the ROM table registers. 


Chapter C10 PMU registers 
This chapter describes the PMU registers. 


Chapter C11 ETM registers 
This chapter describes the ETM registers. 


Chapter C12 CTI registers 
This chapter describes the CTI registers. 


Part D Appendices 


Appendix A Signal Descriptions 
This appendix describes the signals at the external interfaces of the processor. 


Appendix B AArch32 UNPREDICTABLE Behaviors 
The cases in which the Cortex-A35 processor implementation diverges from the preferred 
behavior described in ARMv8 AArch32 UNPREDICTABLE behaviors. 
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Appendix C Revisions 
This appendix describes the technical changes between released issues of this book. 


Glossary 


The ARM Glossary is a list of terms used in ARM documentation, together with definitions for those 
terms. The ARM Glossary does not contain terms that are industry standard unless the ARM meaning 
differs from the generally accepted meaning. 


See the ARM Glossary for more information. 


Typographic conventions 
italic 
Introduces special terminology, denotes cross-references, and citations. 
bold 
Highlights interface elements, such as menu names. Denotes signal names. Also used for terms 
in descriptive lists, where appropriate. 
monospace 
Denotes text that you can enter at the keyboard, such as commands, file and program names, 
and source code. 
monospace 
Denotes a permitted abbreviation for a command or option. You can enter the underlined text 
instead of the full command or option name. 
monospace italic 
Denotes arguments to monospace text where the argument is to be replaced by a specific value. 
monospace bold 
Denotes language keywords when used outside example code. 


<and> 
Encloses replaceable terms for assembler syntax where they appear in code or code fragments. 
For example: 
MRC p15, ©, <Rd>, <CRn>, <CRm>, <Opcode_2> 
SMALL CAPITALS 


Used in body text for a few terms that have specific technical meanings, that are defined in the 
ARM glossary. For example, IMPLEMENTATION DEFINED, IMPLEMENTATION SPECIFIC, UNKNOWN, and 
UNPREDICTABLE. 

Timing diagrams 


The following figure explains the components used in timing diagrams. Variations, when they occur, 
have clear labels. You must not assume any timing information that is not explicit in the diagrams. 


Shaded bus and signal areas are undefined, so the bus or signal can assume any value within the shaded 
area at that time. The actual level is unimportant and does not affect normal operation. 


Clock 





L | 


HIGH to LOW | \ 
Transient Vv. 
HIGH/LOW to HIGH [J 
Bus stabe 
Bus to high impedance J 
Bus change KK. 
High impedance to stable bus 2 


Figure 1 Key to timing diagram conventions 
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Signals 
The signal conventions are: 


Signal level 
The level of an asserted signal depends on whether the signal is active-HIGH or active-LOW. 
Asserted means: 
¢ HIGH for active-HIGH signals. 
e LOW for active-LOW signals. 


Lowercase n 
At the start or end of a signal name denotes an active-LOW signal. 


Additional reading 


This book contains information that is specific to this product. See the following documents for other 
relevant information. 


ARM publications 
e ARM” AMBA” AXI and ACE Protocol Specification AXI, AXI4, and AXI4-Lite, ACE and 
ACE-Lite (ARM IHI 0022). 


¢ ARM” AMBA” APB Protocol Specification (ARM IHI 0024). 

+ ARM” AMBA® ATB Protocol Specification (ARM IHI 0032). 

+ ARM” Low Power Interface Specification O-Channel and P-Channel Interfaces (ARM IHI 
0068). 

e ARM® Architecture Reference Manual ARMVv8, for ARMv8-A architecture profile (ARM DDI 
0487). 

e ARM” Generic Interrupt Controller Architecture Specification (ARM IHI 0069). 

+ ARM” Embedded Trace Macrocell Architecture Specification ETMv4 (ARM IHI 0064). 

e ARM” CoreSight™ Architecture Specification (ARM IHI 0029). 

e ARM” Cortex-A Series Programmer s Guide for ARMv8-A (ARM DEN 0024). 


The following confidential books are only available to licensees: 

e ARM” Cortex®-A35 Configuration and Sign-off Guide (ARM 100239). 

e ARM” Cortex®-A35 Processor Integration Manual (ARM 100240). 

e ARM” Cortex®-A35 Processor Cryptographic Extension Technical Reference Manual (ARM 
100237). 

+ ARM” Cortex®-A35 Processor Advanced SIMD and Floating-point Support Technical 
Reference Manual (ARM 100238). 

e ARM” AMBA” 5 CHI Protocol Specification (ARM IHI 0050). 

e ARM” ARMV8 AArch32 UNPREDICTABLE behaviors (PRD03-GENC-010544). 


Other publications 
This section lists relevant documents published by third parties: 
e ANSIAIEEE Std 754-2008, IEEE Standard for Binary Floating-Point Arithmetic. 





Note 


ARM floating-point terminology is largely based on the earlier ANSI/IEEE Std 754-1985 issue 
of the standard. See the ARM® Architecture Reference Manual ARMVv8, for ARMv8-A 
architecture profile for more information. 








ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 23 
reserved. 
Non-Confidential 


Preface 
Feedback on this product 


Feedback 


Feedback on this product 


If you have any comments or suggestions about this product, contact your supplier and give: 

e The product name. 

e The product revision or version. 

e An explanation with as much information as you can provide. Include symptoms and diagnostic 
procedures if appropriate. 


Feedback on content 


If you have comments on content then send an e-mail to errata@arm.com. Give: 


¢ The title ARM® Cortex®-A35 Processor Technical Reference Manual. 
e The number ARM 100236 0002 _00_en. 

e Ifapplicable, the page number(s) to which your comments refer. 

e A concise explanation of your comments. 


ARM also welcomes general suggestions for additions and improvements. 
Note 


ARM tests the PDF only in Adobe Acrobat and Acrobat Reader, and cannot guarantee the quality of the 
represented document when used with any other PDF reader. 
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Functional Description 


Chapter A1 
Introduction 


This chapter provides an overview of the Cortex-A35 processor and its features. 


It contains the following sections: 

e Al.1 About the Cortex*-A35 processor on page A1-28. 

e A1.2 Features on page A1-29. 

¢ A1.3 Implementation options on page A1-30. 

¢ Al.4 Supported standards and specifications on page A1-32. 
e A1.5 Test features on page A1-33. 

e A1.6 Design tasks on page A1-34. 

e Al1.7 Product revisions on page A1-35. 
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A1.1 About the Cortex®-A35 processor 


The Cortex-A35 processor is a product designed to give mid-range instruction execution performance 
with low power consumption. It is highly configurable, allowing you to select features that are 
appropriate for the SoC in which it is used. 


The major configuration options are: 


e One to four ARMv8-A compliant cores with automatic data cache coherency. 
e One shared L2 cache. 
e An AXI, ACE, or CHI system bus interface. 


The processor also contains: 

e Logic to help with power management. 

e GICv4 interrupt capability. 

e A complete CoreSight subsystem to support embedded debug in each core. 

e An optional ACP that allows for I/O coherent operations with an external master, for example a DMA 
engine. 


The following figure shows an example configuration with four cores, an L2 cache, and a CHI system 
bus interface. 




























































































Processor 
Core 0 SCU 
L2 cache* em CH 
ACP* — je —— Axim 
ry 
Core 1* 
CoreSight 
infrastructure Debug 
coe Power 
management {aha 
ATI 
Core 3 DFT. 
Test 
<+—wMBIST—> 
*Optional 


Interrupt interface 


Figure A1-1 Example processor configuration 


Related information 

Al.2 Features on page A1-29. 

A1.3 Implementation options on page A1-30. 

A1.4 Supported standards and specifications on page A1-32. 
A1.5 Test features on page A1-33. 

A2.1 Components on page A2-38. 

A2.2 Interfaces on page A2-42. 
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A1.2 Features 


The Cortex-A35 processor includes the following features: 


Full implementation of the ARMv8-A A64, A32, and T32 instruction sets. 

Both the AArch32 and AArch64 execution states at all Exception levels (ELO to EL3). 

In-order pipeline with direct and indirect branch prediction. 

Separate Level / (L1) data and instruction side memory systems with a Memory Management Unit 
(MMU). 

Level 2 (L2) memory system that provides cluster memory coherency. 

Optional L2 cache. 

Cache protection in the form of Error Correction Code (ECC) or parity on all RAM instances, except 
for the L2 victim RAM. There are two implementation options: 

— CPU cache protection. 

— Snoop Control Unit (SCU)-L2 cache protection. 

TrustZone®. 

Optional data engine that implements the Advanced SIMD and floating-point architecture support. 
Optional Cryptographic Extension. This architectural extension is only available if the data engine is 
present. 

ARMvVv8 debug logic. 

Performance Monitoring Unit (PMU). 

Optional Embedded Trace Macrocell (ETM) that supports instruction trace only. 

Optional Generic Interrupt Controller (GIC) CPU interface to connect to an external distributor. 
Generic Timers supporting 64-bit count input from an external system counter. 


Related information 
A1.3 Implementation options on page A1-30. 


A1.4 Supported standards and specifications on page A1-32. 


A6.1 About the LI memory system on page A6-86. 


A7.1 About the L2 memory system on page A7-94. 


45.7 About cache protection on page A5-80. 
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A1 Introduction 
A1.3 Implementation options 


The Cortex-A35 processor is highly configurable. Build-time configuration options make it possible to 
meet functional requirements with the smallest possible area and power. In a configuration with more 
than one core, all cores have the same build-time configuration. 


The following table lists the implementation options for a core. 


Table A1-1 Implementation options for a core 














e Not included 


Feature Range of options | Notes 
L1 instruction cache size * 8K 
e 16K 
e 32K 
e 64K 
L1 data cache size e 8K 
e 16K 
e 32K 
e 64K 
CPU cache protection * Included e Not available if the L2 cache is implemented without SCU-L2 


cache protection. 
e Also protects the L1 duplicate tags in the SCU. 








GIC CPU interface ¢ Included 
e Not included 
ETM ¢ Included 


e Not included 





Advanced SIMD and floating-point support |}* Included 


e Not included 





Cryptographic Extension 





¢ Included 
e Not included 











There is no option to implement the Cryptographic Extension 
without the Advanced SIMD and floating-point support. 








The following table lists the implementation options at build time for the processor. 


Table A1-2 Implementation options for the processor 





Feature 


Range of options 


Notes 





Number of cores 


e 
BRwWN Ke 


All cores have the same build-time configuration. 





Main bus interface 


e AMBA4 AXI 
e AMBA 4 ACE 
e AMBA 5 CHI 





L2 cache 








¢ Included 
e Not included 





If it is present, all cores share one L2 cache. 
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Table A1-2 Implementation options for the processor (continued) 

















Feature Range of options Notes 
L2 cache size © 128K 
© 256K 
e 512K 
« 1024K 
L2 data RAM input latency e Icycle 
e 2cycles 
L2 data RAM output latency e 2cycles 
e 3-cycles 
SCU-L2 cache protection e Included Protects the L2 tag and L2 data RAMs with ECC. 


¢ Not included 





Accelerator Coherency Port (ACP) 


¢ Included 
e Not included 


Part of the SCU-L2. If the processor does not include an L2 cache, it 
cannot implement the ACP. 





Debug memory map 








e v8 debug memory map 
e v7 debug memory map 








Related information 
A2.2 Interfaces on page A2-42. 
45.5 Invalidating or cleaning a cache on page AS-78. 


A6.1 About the LI memory system on page A6-86. 


A7.1 About the L2 memory system on page A7-94. 


A5.7 About cache protection on page A5-80. 
Chapter A12 GIC CPU Interface on page A12-137. 
C1.6 Debug memory map on page C1-555. 

C3.1 About the ETM on page C3-570. 
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A1.4 Supported standards and specifications 


A1.4 Supported standards and specifications 


The Cortex-A35 processor implements the ARMv8-A architecture and some architecture extensions. It 
also supports various interconnect, interrupt, timer, debug, and trace architectures. 


Table A1-3 Compliance with standards and specifications 





Architecture specification | Version Notes 
or standard 





ARM architecture ARMv8s-A e AArch64 and AArch32 execution states. 
e All Exception levels in each execution state. 
e A64, A32, and T32 instruction sets. 























ARM architecture extensions e Advanced SIMD and floating- « You cannot implement floating-point without 
point support Advanced SIMD. 

e Cryptographic Extension e You cannot implement the Cryptographic Extension 
without the Advanced SIMD and floating-point 
support. 

Interconnect e AMBA4 AXI You can also connect the processor to an AMBA 3 AXI 

e AMBA 4 ACE interconnect. 

e AMBA 5CHI 

Generic Interrupt Controller v4 - 
Generic Timer ARMv8-A - 
PMU v3 - 
Debug ARMv8 - 
CoreSight v2 - 





Embedded Trace Macrocell ETMv4 - 

















Related information 

ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile. 

ARM® AMBA® 5 CHI Protocol Specification. 

ARM® AMBA® AXI and ACE Protocol Specification AXI3, AXI4, and AXT4-Lite, ACE and ACE-Lite. 
ARM® Generic Interrupt Controller Architecture Specification. 

ARM® CoreSight™ Architecture Specification. 

ARM® ETM Architecture Specification, ETMv4. 
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A1.5 Test features 


A1.5 Test features 


The Cortex-A35 processor provides test signals that enable the use of both ATPG and MBIST to test the 
processor and its memory arrays. 


Related information 
A.20 DFT interface signals on page Appx-A-842. 
A.21 MBIST interface signals on page Appx-A-843. 
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A1.6 Design tasks 


A1.6 Design tasks 


The Cortex-A35 processor is delivered as a synthesizable Register Transfer Level (RTL) description in 
the Verilog HDL. Before you can use it, you must implement, integrate, and program it. 


A different party can perform each of the following tasks. Each task can include implementation and 
integration choices that affect the behavior and features of the processor. 


Implementation 
The implementer configures and synthesizes the RTL to produce a hard macrocell. This task 
includes integrating RAMs into the design. 

Integration 
The integrator connects the macrocell into a SoC. This task includes connecting it to a memory 
system and peripherals. 

Programming 
It is the last task. The system programmer develops the software to configure and initialize the 
processor and tests the application software. 


The operation of the final device depends on the following: 


Build configuration 
The implementer chooses the options that affect how the RTL source files are pre-processed. 
These options usually include or exclude logic that affects one or more of the area, maximum 
frequency, and features of the resulting macrocell. 

Configuration inputs 
The integrator configures some features of the processor by tying inputs to specific values. 
These configuration settings affect the start-up behavior before any software configuration is 
made. They can also limit the options available to the software. 

Software configuration 
The programmer configures the processor by programming particular values into registers. The 
configuration choices affect the behavior of the processor. 





ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights A1-34 
reserved. 
Non-Confidential 


A1 Introduction 
A1.7 Product revisions 


A1.7 Product revisions 


This section describes the differences in functionality between product revisions. 





r0p0 First release. 
r0p1 There are no functional changes in this release. 
r0p2 There are no functional changes in this release. 
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Chapter A2 
Technical Overview 


This chapter describes the structure of the Cortex-A35 processor. 


It contains the following sections: 

e 42.1 Components on page A2-38. 

e A2.2 Interfaces on page A2-42. 

e A2.3 About system control on page A2-44. 

e A2.4 About the Generic Timer on page A2-45. 
e A2.5 About the memory model on page A2-46. 
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A2.1 Components 


The Cortex-A35 processor consists of: 


A2 Technical Overview 
A2.1 Components 


e One to four cores, each with its own governor block. The governor block provides functionality that 


remains required when the core is in retention. 


e An SCU-L2 memory system block. The SCU maintains data coherency between the L1 data caches 
and the L2 cache. It also connects the cores to an external memory system using an AXI, ACE, or 
CHI master interface. A mini-SCU replaces the SCU in configurations that do not require the SCU 
functionality. The mini-SCU is instantiated in implementations that are configured with a single core, 
no L2 cache, no CPU cache protection, and an AXI master interface. 


The processor also integrates CoreSight components, and optionally integrates cache protection and the 


Cryptographic Extension. 


The following figure shows a top-level functional diagram of the Cortex-A35 processor. 
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Figure A2-1 Cortex-A35 processor block diagram 


Instruction Fetch Unit (IFU) 


The IFU obtains instructions from the instruction cache or from external memory and predicts the 
outcome of branches in the instruction stream. It passes the instructions to the Data Processing Unit 


(DPU) for processing. 
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A2 Technical Overview 
A2.1 Components 


In implementations with CPU cache protection, parity bits protect the L1 Instruction cache data and tag 
RAMs by enabling the detection of any single-bit error. If an error is detected, the line is invalidated and 


fetched again. 


Data Processing Unit (DPU) 


The DPU decodes and executes instructions. It executes instructions that require data transfer to or from 
the memory system by interfacing to the Data Cache Unit (DCU). The DPU includes the Performance 
Monitor Unit (PMU), the Advanced SIMD and floating-point support, and the Cryptographic Extension. 


The PMU provides six performance monitors that can be configured to gather statistics 
on the operation of each core and the memory system. The information can be used for 
debug and code profiling. 


Advanced SIMD and floating-point support 


Advanced SIMD is a media and signal processing architecture that adds instructions 
primarily for audio, video, 3-D graphics, image, and speech processing. The floating- 
point architecture provides support for single-precision and double-precision floating- 
point operations. 

All scalar floating-point instructions are available in the A64 instruction set. All VFP 
instructions are available in the A32 and T32 instruction sets. The same Advanced 
SIMD instructions are available in both the A32 and T32 instruction sets. The A64 
instruction set offers additional Advanced SIMD instructions, including double- 
precision floating-point vector operations. 


Note 


The Advanced SIMD architecture, its associated implementations, and supporting 
software, are also referred to as NEON technology. 





Cryptographic Extension 


The optional Cortex-A35 processor Cryptographic Extension supports the ARMv8 

Cryptographic Extensions. It can be configured at implementation time and applies to 

all cores. The Cryptographic Extension adds new instructions to Advanced SIMD that 

accelerate: 

¢ Advanced Encryption Standard (AES) encryption and decryption. 

¢ The Secure Hash Algorithm (SHA) functions SHA-1, SHA-224, and SHA-256. 

e Finite field arithmetic used in algorithms such as Galois/Counter Mode and Elliptic 
Curve Cryptography. 


Memory Management Unit (MMU) 


The MMU provides fine-grained memory system control through a set of virtual-to-physical address 
mappings and memory attributes that are held in translation tables. These are loaded into the Translation 
Lookaside Buffer (TLB) when a location is accessed. The TLB entries include global and application 
specific identifiers to prevent context switch TLB flushes. They also include Virtual Machine Identifiers 
(VMIDs) to prevent TLB flushes on virtual machine switches by the hypervisor. 


Micro TLBs 


The first level of caching for the translation table information is a micro TLB of ten 
entries. It is implemented on each of the instruction and data sides. All main TLB 
related maintenance operations result in flushing both the instruction and data micro 
TLB. 


Main TLB 


A unified main TLB handles misses from the micro TLBs. 


In implementations with CPU cache protection, parity bits protect the TLB RAMs by 
enabling the detection of any single-bit error. If an error is detected, the entry is flushed 
and fetched again. 
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A2 Technical Overview 
A2.1 Components 


L1 data-side memory system 


The L1 data-side memory system includes the Data Cache Unit (DCU), the Store Buffer (STB), and the 
Bus Interface Unit. 


DCU 
The DCU manages all load and store operations. 


In implementations with CPU cache protection, parity bits protect the L1 Data cache 
tag RAMs and dirty RAMs. The L1 Data cache data RAMs are protected using Error 
Correction Codes (ECC). The ECC scheme is Single Error Correct Double Error Detect 
(SECDED). The DCU includes a combined local and global exclusive monitor that is 
used by the Load-Exclusive/Store-Exclusive instructions. 


STB 
The STB holds store operations when they have left the load/store pipeline in the DCU 
and have been committed by the DPU. The STB can request access to the cache RAMs 
in the DCU, request the BIU to initiate linefills, or request the Bus Interface Unit (BIU) 
to write out the data on the external write channel. External data writes are through the 
SCU. 


The STB is also used to queue maintenance operations before they are broadcast to 
other cores in the processor. 


BIU 
The BIU contains the SCU interface and buffers to decouple the interface from the L1 
Data cache and STB. The BIU and the SCU always operate at the processor frequency. 


Governor 


The governor block, outside the core, includes all functions that must remain operating while a core is in 
retention mode. 


GIC CPU interface 
The GIC CPU interface is a memory-mapped interface through which a core receives 
an interrupt. The GIC Distributor can read and write the GIC CPU interface registers 
even while the core is in retention mode. 

Generic timer 
The Generic Timer has an interface to an external system counter. It provides a 
consistent view of time, which can be used to schedule events and trigger interrupts. It 
is also used by the retention circuits in the processor. 


L2 Memory System 


The L2 memory system contains the L2 cache pipeline and all the logic that maintains memory 
coherence between the cores in the cluster. 


SCU 
The SCU connects the cores to the external memory system through the master 
memory interface. It also maintains data cache coherency between the cores and 
arbitrates L2 requests from the cores. 

mini-SCU 
The mini-SCU replaces the SCU in certain uniprocessor configurations that do not 
require data cache coherency with other masters in the system. That is, implementations 
that are configured to have a single core, no L2 cache, no CPU cache protection, and an 
AXI interface. The mini-SCU bridges between the master interface of the core and the 
AXI master interface of the processor. 
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A2 Technical Overview 
A2.1 Components 


L2 cache 
Each Cortex-A35 cluster can include an optional L2 cache that participates in the 
coherency protocol. Each L2 cache is 8-way set associative, supports 64-byte cache 
lines, and has a configurable cache RAM size between 128KB and 1MB. 

ACP 
The ACP interface cannot be configured without an L2 cache because it reuses 
buffering and data paths implemented for the L2 cache to achieve optimal efficiency. 
The main advantage of the ACP interface is its ability to allocate data in the L2 cache 
RAMs. 


Debug and trace components 


Cross-trigger 
The Cross Trigger Matrix (CTM) combines the CoreSight Cross Trigger Interface 
(CTI) channel signals from all the cores so that a single cross trigger channel interface 
is presented in the Cortex-A35 processor. This module can combine up to four internal 
channel interfaces corresponding to each core along with one external channel 
interface. 

Debug ROM 


The Cortex-A35 processor has a debug ROM which is a CoreSight feature. 
ETM 


The ETM trace unit is a build-time configuration option. This module performs real- 
time instruction flow tracing that complies with the ETM architecture. 


Related information 

A2.2 Interfaces on page A2-42. 

A6.1 About the LI memory system on page A6-86. 

A7.1 About the L2 memory system on page A7-94. 

Chapter A3 Clocks, Resets, and Input Synchronization on page A3-47. 
Chapter A4 Power Management on page A4-53. 
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A2 Technical Overview 
A2.2 Interfaces 


The Cortex-A35 processor has several interfaces to connect it to a SoC. 
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Table A2-1 Cortex-A35 interfaces 


















































Purpose Technology Notes 
PMU events Performance events provide useful information on the operation of the processor that 
you can use for debug and code profiling. A subset of available performance events is 
exported on the PMU event bus. 
Trace ATB Optional 
Outputs trace information for debugging. The ATB interface is compatible with the 
CoreSight architecture. 
Memory AXI, ACE, or CHI | ACE can also be used with AXI peripherals. 
ACP AXI Optional 
This slave interface reduces software cache maintenance operations when the cores 
share memory regions with other masters and allows other masters to allocate data into 
the L2 cache. It allows an external master to make coherent requests to shared memory, 
but it does not support cache maintenance, coherency, barrier, or DVM transactions. 
Debug APB Allows access to debug registers and resources, for example, to set watchpoints and 
breakpoints. 
Cross-trigger CTI This external interface is connected to the CoreSight CTI corresponding to each core 
through a simplified CTM. 
Design for Test (DFT) Allows an industry standard Automatic Test Pattern Generation (ATPG) tool to test 
logic. 
Memory Built-In Self Provides support for manufacturing test of the memories embedded in the Cortex-A35 
Test (MBIST) processor. 
Power management Q-channel Enables communication to an external power controller. 
Related information 
Chapter A9 ACE Master Interface on page A9-109. 
Chapter A10 CHI Master Interface on page A10-121. 
Chapter A8 AXI Master Interface on page A8-101. 
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A2.2 Interfaces 


C1.2 Debug access on page C1-551. 

C2.1 About the PMU on page C2-560. 

C3.1 About the ETM on page C3-570. 

C4.1 About the cross-trigger on page C4-578. 

ARM® AMBA® AXI and ACE Protocol Specification AXI3, AXI4, and AXT4-Lite, and ACE and ACE- 
Lite. 

ARM® AMBA® 5 CHI Protocol Specification. 

ARM® CoreSight™ Architure Specification. 
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A2.3 About system control 


A2.3 About system control 


The system registers control and provide status information for the functions that the processor 
implements. 


The main functions of the system registers are: 


e Overall system control and configuration. 

e MMU configuration and management. 

e Configuration and management of the L1 and the L2 caches. 
e System performance monitoring. 

e GIC configuration and management. 


The system registers are accessible in the AArch64 and AArch32 Execution states. Some of the system 
registers are accessible through the memory-mapped or external debug interfaces. 


Related references 
B1.1 AArch32 register summary on page B1-146. 
B2.1 AArch64 register summary on page B2-350. 
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A2.4 About the Generic Timer 


A2.4 About the Generic Timer 


The Generic Timer can schedule events and trigger interrupts that are based on an incrementing counter 
value. It generates timer events as active-LOW interrupt outputs and event streams. 


The Cortex-A35 processor does not include the system counter. This resides in the SoC. The system 
counter value is distributed to the Cortex-A35 processor with a synchronous binary encoded 64-bit bus, 
CNTVALUEB[63:0]. 


Because CNT VALUEB[63:0] is generated from a system counter that typically operates at a slower 
frequency than the processor clock, CLKIN, the CNTCLKEN input is provided. CNTCLKEN is 
registered inside the processor and then used as a clock enable for CNTVALUEB[63:0]. This allows a 
multicycle path to be applied to the CNTVALUEB[63:0]. The following figure shows the interface. 
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Figure A2-3 Generic Timer interface 


The value on CNTVALUEB[63:0] is required to be stable whenever the internally registered version of 
the CNTCLKEN clock enable is asserted. CNTCLKEN must be synchronous and balanced with 
respect to CLKIN and must toggle at integer ratios of the processor CLKIN. 


Related information 
A.6 Generic Timer signals on page Appx-A-819. 
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A2.5 About the memory model 


The processor views memory as a linear collection of bytes numbered in ascending order from zero. For 
example, bytes 0-3 hold the first stored word, and bytes 4-7 hold the second stored word. 


The processor can store words in memory in big-endian or little-endian format. Instructions are always 
little-endian. 


Related information 
ARM® Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile. 
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Chapter A3 
Clocks, Resets, and Input Synchronization 


This chapter describes the clocks of the Cortex-A35 processor. It also describes the reset options. 


It contains the following sections: 

e A3.1 Clocks on page A3-48. 

e A3.2 Input synchronization on page A3-49. 
e A3.3 Resets on page A3-50. 
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A3.1 Clocks 


A3.1 Clocks 


The Cortex-A35 processor has a single clock input, CLKIN. All cores in the Cortex-A35 processor and 
the SCU are clocked with a distributed version of CLKIN. 


The Cortex-A35 processor has the following clock enable signals: 
e PCLKENDBG. 

e ACLKENM. 

e ACLKENS. 

e SCLKEN. 

e ATCLKEN. 

e CNTCLKEN. 


For more information, see the ARM® Cortex®-A35 Processor Integration Manual. 
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A3 Clocks, Resets, and Input Synchronization 
A3.2 Input synchronization 


The Cortex-A35 processor synchronizes certain input signals. The SoC can present these inputs 
asynchronously. All other external signals must be synchronous with reference to CLKIN. 


Input signals that the Cortex-A35 processor synchronizes: 


nCORERESET. 
nCPUPORESET. 
nFIQ. 

nIRQ. 
nL2RESET. 
nMBISTRESET. 
nPRESETDBG. 
nREI. 

nSEI. 

nVFIQ. 

nVIRQ. 

nVSEL. 


CLREXMONREQ. 


CPUQREQn. 
CTICHOUTACK. 
CTIIRQACK. 
DBGEN. 
EDBGRQ. 
EVENTI. 
L2FLUSHREQ. 
L2QREQn. 
NEONQREQn. 
NIDEN. 

SPIDEN. 
SPNIDEN. 


Input signals that the Cortex-A35 processor synchronizes under certain conditions: 


CTICHIN. 


The synchronized CTICHIN input signals are used only if the CISBYPASS input signal is deasserted 
LOW. If the CISBYPASS signal is asserted HIGH the CTICHIN synchronizers are not used, and the 


SoC must present the CTICHIN synchronously to CLKIN. 
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A3.3 Resets 


A3.3 Resets 


The Cortex-A35 processor has active-LOW reset input signals that can be asynchronously asserted 
HIGH to LOW, or deasserted LOW to HIGH. 


nCPUPORESET[CN:0] 
Where CN is the number of cores minus one. 


Power On reset signals. These primary, cold reset signals initialize all resettable registers in the 
corresponding core, including debug registers and ETM registers. 


nCORERESET[CN:0] 
These primary reset signals initialize all resettable registers in the corresponding core, not 
including debug registers and ETM registers. 

nPRESETDBG 
This single, processor-wide signal resets the integrated CoreSight components that connect to 
the external PCLK domain, such as debug logic. 

nL2RESET 
This single, processor-wide signal resets all resettable registers in the L2 memory system and 
the logic in the SCU or mini-SCU. 

nMBISTRESET 
An external MBIST controller can use this signal to reset the entire SoC. The nMBISTRESET 
signal resets all resettable registers in the cluster, for entry into, and exit from, MBIST mode. 


Reset synchronization logic inside the processor ensures that reset deassertion is synchronous for all 
resettable registers. The processor clock is not required for reset assertion, but it must be present for reset 
deassertion to ensure reset synchronization. 


In general, the reset time only requires three processor clock cycles. 

Note 
The application of a retention state can affect how long reset assertion is required. You must hold the 
reset signal active-LOW until the power returns and the unit or processor is ready for the reset to take 
effect if: 
e The Advanced SIMD and floating-point unit of a core undergoing a reset is in retention state. 
e A core that is being reset is in retention state. 





The time that is taken for retention exit and the behavior of the power controller varies by partner and by 
implementation. 





The following table describes the valid reset signal combinations. All other combinations of reset signals 
are illegal. In the table, n designates the core that is reset. 
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A3 Clocks, Resets, and Input Synchronization 
A3.3 Resets 


Table A3-1 Valid reset combinations 























Reset combination Signals Value | Description 
Cluster cold reset nCPUPORESET/[CN:0] | all =0 | All logic is held in reset. 
nCORERESET/[CN:0] | all =X | nCORERESET can be asserted, but is not required. 
nPRESETDBG 0 
nL2RESET 0 
nMBISTRESET 1 
Cluster cold reset with debug | nCPUPORESET[CN:0] | all =0 | All cores are held in reset so they can be powered up. The L2 is 
active nCORERESET[CN:0] | all =X held in reset, but must remain powered up. This enables external 
debug over power down for the cluster. 
reer ers : nCORERESET can be asserted, but is not required. 
nL2RESET 0 
nMBISTRESET 1 
Individual core cold reset nCPUPORESET[CN:9] | [n] =0 | Individual core is held in reset, so that the core can be powered up. 
with debug active nCORERESET[CN:0] | [n] =X This enables external debug over power down for the core that is 
held in reset. 
MPRESETDBEG l nCORERESET can be asserted, but is not required. 
nL2RESET 1 
nMBISTRESET 1 
Individual core warm reset nCPUPORESET[CN:0] | [n] = 1 | Individual core is held in reset. 
with trace and debug active nCORERESET[CN:0] |[n]=0 
nPRESETDBG 1 
nL2RESET 1 
nMBISTRESET 1 
Debug logic reset nCPUPORESET[CN:0] |all=1 | Cluster debug logic is held in reset. 
nCORERESET[CN:0] | all=1 
nPRESETDBG 0 
nL2RESET 1 
nMBISTRESET 1 
MBIST reset nCPUPORESET[CN:0] |all=1 | All logic is held in reset. 
nCORERESET[CN:0] | all=1 
nPRESETDBG 1 
nL2RESET 1 
nMBISTRESET 0 





Normal state 








nCPUPORESET[CN:0] 
nCORERESET[CN:0] 
nPRESETDBG 
nL2RESET 
nMBISTRESET 








No logic is held in reset. 
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A3.3 Resets 
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Chapter A4 
Power Management 


This chapter describes the power domains and the power modes in the Cortex-A35 processor. 


It contains the following sections: 

e A4.1 Power domains on page A4-54. 

e A4.2 Power modes on page A4-57. 

e A4.3 Core Wait for Interrupt on page A4-58. 

e A4.4 Core Wait for Event on page A4-59. 

e A4.5 L2 Wait for Interrupt on page A4-60. 

e A4.6 Powering down an individual core on page A4-61. 

e A4.7 Powering up an individual core on page A4-62. 

e A4.8 Powering down the processor without system driven L2 flush on page A4-63. 
e A4.9 Powering up the processor without system driven L2 flush on page A4-64. 
e A4.10 Powering down the processor with system driven L2 flush on page A4-65. 
e A4.11 Powering up the processor with system driven L2 flush on page A4-66. 

¢ A4.12 Entering Dormant mode on page A4-67. 

¢ A4.13 Exiting Dormant mode on page A4-68. 

¢ A4.14 Event communication using WFE or SEV on page A4-69. 

e 44.15 Communication to the Power Management Controller on page A4-70. 

e A4.16 STANDBYWFI/[3:0] and STANDBYWFIL2 signals on page A4-71. 

e A4.17 Q-channel on page A4-72. 
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A4 Power Management 
A4.1 Power domains 


A4.1 Power domains 


A core or a processor can support different power domains. Each power domain has valid and accepted 
power states. 


The Cortex-A35 processor provides mechanisms and support to control both dynamic and static power 
dissipation. The individual cores in the Cortex-A35 processor support four main levels of power 
management which correspond to the power domains shown in the following table: 


Table A4-1 Power domain description 
































Power domain Description 
PDMERCURY Includes the SCU, the optional L2 cache control logic, and debug registers that are described as being in the 
debug domain. 
PDL2 Includes the L2 data RAM, L2 tag RAM, L2 victim RAM, and the SCU duplicate tag RAM. 
PDCPU<n> Includes the optional Advanced SIMD and floating-point support, the L1 cache and TLB RAMs, and the 
debug registers that are described as being in the processor domain. 
nis 0, 1, 2, or 3. It represents core 0, core 1, core 2, or core 3. If a core is not present, the corresponding 
power domain is not present. 
PDCPUADVSIMD<n> | Represents the Advanced SIMD and floating-point block of core n. 
nis 0, 1, 2, or 3. It represents core 0, core 1, core 2, or core 3. If a core is not present, the corresponding 
power domain is not present. 
The separate PDMERCURY and PDL2 power domains can remain active even when all the cores are 
powered down. It means that the processor can continue to accept snoops from external devices to access 
the L2 cache. 
The following figure shows an example of the domains embedded in a System-on-Chip (SoC) power 
domain. 
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Figure A4-1 Power domains 


The power domains can be controlled independently to give different combinations of powered-up and 
powered-down domains. However, only some powered-up and powered-down domain combinations are 


valid and supported. 


Table A4-2 Power state description 














Power state | Description 

Off Block is power gated 

Ret Logic or RAM retention power only 
On Block is active 














The following tables show the supported power domain states for the processor. 
Caution 
States that are not shown in the tables are unsupported and must not occur. 





Table A4-3 Supported processor power states 
































Power domains Description 
PDMERCURY |PDL2 | PDCPU<n> 
Off Off Off Processor off. 
Off On/Ret | Off L2 cache dormant mode. 
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Table A4-3 Supported processor power states (continued) 




















Power domains Description 
PDMERCURY | PDL2 | PDCPU<n> 
On Ret See Table A4-4 Supported core power states Processor on, L2 RAMs retained. 
aap ree All cores either off or in WFx. 
This is an L2 RAM retention entry or residency 
condition. 
On Ret See Table A4-4 Supported core power states Processor on, L2 RAMs retained. 
SE page tense At least one core running. 
This is a transient condition. 
On On See Zable A4-4 Supported core power states Processor on, SCU/L2 RAMs active. 








on page A4-56 











The following table describes the supported power domain states for individual cores. The power domain 
state in each core is independent of all other cores. 


Table A4-4 Supported core power states 





























Power domains Description 
PDCPU | PDPADVSIMD 
Off Off Core off. 
On On Core on. Advanced SIMD and floating-point on. 
On Ret AdvSIMD retention. Advanced SIMD and floating-point in retention. 
Ret Ret Core retention. Core logic and Advanced SIMD and floating-point in retention. 








You must follow the dynamic power management and powerup and powerdown sequences described in 
the following sections. Any deviation from these sequences can lead to unpredictable results. 
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A4.2 Power modes 
The processor supports the following power modes: 


Normal mode 
This is the normal mode of operation in which all of the processor functionality is available. The 
Cortex-A35 processor uses gated clocks to disable inputs to unused functional blocks. Only the 
logic used to perform an operation consumes any dynamic power. 

Standby mode 
When a Cortex-A35 core is in standby mode, it is architecturally clock gated at the top of the 
clock tree. Each core in the cluster can be put in standby mode separately from the other cores, 
by executing a Wait for Interrupt (WFI) or Wait for Event (WFE) instruction. 

L2 standby mode 
When all the cores are in standby mode and the L2 memory system is idle. 

Individual core shutdown mode 
The PDCPU power domain for an individual core is shut down and the state held in this domain 
is lost. 

Cluster shutdown mode 
The PDMERCURY, PDL2, and all PDCPU power domains are shut down and the state held in 
these domains is lost. 

Dormant mode (optional) 
All the cores and L2 control logic are powered down while the L2 cache RAMs are powered up 
and retain state. The RAM blocks that remain powered up during Dormant mode are: 
e L2 tag RAMs. 
e L2 data RAMs. 
e L2 victim RAM. 


Retention mode 
Contact ARM for information about retention state. 
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A4.3 Core Wait for Interrupt 


Programmers can use the Wait for Interrupt (WFT) instruction to cause the core to enter a low-power 
state. 


Wait for Interrupt is a feature of the ARMv8-A architecture that puts the core in a low-power state by 
disabling most of the clocks in the core while keeping the core powered up. Apart from a small dynamic 
power overhead on the logic to enable the core to wake up from WFI low-power state, this reduces the 
power drawn to static leakage current only. 


When executing the WFI instruction, the core waits for all instructions in the core to retire before entering 
the idle or low power state. The WFI instruction ensures that all explicit memory accesses that occurred 
before the WFI instruction in program order have retired. For example, the WFI instruction ensures that 
the following instructions received the required data or responses from the L2 memory system: 


¢ Load instructions. 
e Cache and TLB maintenance operations. 
¢ Store exclusive instructions. 


In addition, the WFI instruction ensures that store instructions have updated the cache or have been issued 
to the SCU. 


While the core is in WFI low-power state, the clocks in the core are temporarily enabled without causing 

the core to exit WFI low-power state, when any of the following events are detected: 

e A snoop request that must be serviced by the core L1 Data cache. 

e A cache or TLB maintenance operation that must be serviced by the core L1 Instruction cache, data 
cache, or TLB. 

e An APB access to the debug or trace registers residing in the core power domain. 


Exit from WFI low-power state occurs when the core detects a reset or one of the WFI wake up events as 
described in the ARM” Architecture Reference Manual ARMV8, for ARMv8-A architecture profile. 


On entry into WFI low-power state, STANDBYWFI for that core is asserted. Assertion of 
STANDBYWFI guarantees that the core is in idle and low-power state. STANDBYWFI continues to 
assert even if the clocks in the core are temporarily enabled because of an L2 snoop request, cache or 
TLB maintenance operation, or an APB access. 


STANDBYWFI does not indicate completion of L2 memory system transactions initiated by the 
processor. All Cortex-A35 processor implementations contain an L2 memory system. This includes 
implementations without an L2 cache. 
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A4.4 Core Wait for Event 


A core can use the Wait for Event (WFE) instruction to cause the core to enter a low-power state. 


Wait for Event (WFE) is a feature of the ARMv8-A architecture. It can be used by a locking mechanism 
based on events to put the core in a low-power state by disabling most of the clocks in the core while 
keeping the core powered-up. Apart from a small dynamic power overhead on the logic to enable the 
core to wake up from WFE low-power state, this reduces the power drawn to static leakage current only. 


When executing the WFE instruction, the core waits for all instructions in the core to complete before 
entering the idle or low-power state. 


If the event register is set, execution of a WFE instruction does not cause entry into standby state, but 
clears the event register. 


While the core is in WFE low-power state, the clocks in the core are temporarily enabled without causing 
the core to exit WFE low-power state, when any of the following events are detected: 


e AnL2 snoop request that must be serviced by the core L1 Data cache. 

e A cache or TLB maintenance operation that must be serviced by the core L1 Instruction cache, data 
cache, or TLB. 

e An APB access to the debug or trace registers residing in the core power domain. 


Exit from WFE low-power state occurs when the core detects a reset, the assertion of the EVENTI input 
signal, or one of the WFE wake-up events as described in the ARM® Architecture Reference Manual 
ARMv8, for ARMv8-A architecture profile. 


On entry into WFE low-power state, STANDBYWFE for that core is asserted. Assertion of 
STANDBYWFE guarantees that the core is in idle and low-power state. STANDBYWFE continues to 
assert even if the clocks in the core are temporarily enabled because of an L2 snoop request, cache or 
TLB maintenance operation, or an APB access. 


CLREXMON request and acknowledge signaling 


When the CLREXMONREQ input is asserted, it signals the clearing of an external global exclusive 
monitor and acts as a WFE wake-up event to all the cores in the cluster. 


The CLREXMONREQ signal has a corresponding CLREXMONACK response signal. This forms a 
standard 2-wire, 4-phase handshake that can be used to signal across the voltage and frequency boundary 
between the core and system. 


The following figure shows the CLREXMON request and acknowledge handshake. When the request 
signal is asserted, it continues to assert until an acknowledge is received. When the request is deasserted, 


the acknowledge can then deassert. 
CLREXMONREQ 
CLREXMONACK 


Figure A4-2 CLREXMON request and acknowledge handshake 
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L2 Wait for Interrupt 


When all the cores are in WFI low-power state, the shared L2 memory system logic that is common to all 
the cores can also enter a WFI low-power state. 


Entry into L2 WFI low-power state can occur only if specific requirements are met and the following 
sequence applied: 


e All cores are in WFI low-power state and therefore, the STANDBYWFI output for each core is 
asserted. Assertion of all the cores STANDBYWFI outputs guarantees that all the cores are in idle 
and low-power state. All clocks in the cores, with the exception of a small amount of clock wakeup 
logic, are disabled. 

e Ifconfigured with ACE, the SoC asserts the input pin ACINACTM to idle the AXI master interface. 
It indicates that no snoop requests will be made from the external memory system. 

e Ifconfigured with a CHI interface, the SoC asserts the input pin SINACT to idle the CHI master 
interface. It indicates that no snoop requests will be made from the external memory system. 

e If configured with an ACP interface, the SoC asserts the AINACTS input pin to idle the ACP 
interface. It indicates that the SoC sends no more transactions on the ACP interface. 


When the L2 memory system completes the outstanding transactions for AXI, ACE, or CHI interfaces, it 
can then enter the L2 WFI low-power state. On entry into L2 WFI low-power state, STANDBY WFIL2 
is asserted. Assertion of STANDBYWFIL2 guarantees that the L2 memory system is idle and does not 
accept new transactions. 


Exit from L2 WFI low-power state occurs on one of the following events: 
e A physical IRQ or FIQ interrupt. 

e A debug event. 

e Powerup or warm reset. 


When a core exits permanently from WFI low-power state, STANDBYWFI for that core is deasserted. 
When the L2 memory system logic exits from WFI low-power state, STANDBYWFIL2 is deasserted. 
The SoC must continue to assert ACINACTM or SINACT until STANDBYWFIL2 has deasserted. 


The following figure shows the L2 WFI timing for a 4-core configuration. 
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A4.6 Powering down an individual core 


To enable a core to be powered down, the implementation must place the core on a separately controlled 
power supply. In addition, you must clamp the outputs of the core to benign values while the entire 
cluster is powered down. 


To power down the core, apply the following sequence: 


Procedure 


1. 


7. 
8. 
9. 


Disable the data cache, by clearing the SCTLR.C bit, or the HSCTLR.C bit if in Hyp mode. This 
prevents more data cache allocations and causes cacheable memory attributes to change to Normal 
Non-cacheable. Subsequent loads and stores do not access the L1 or L2 caches. 

Clean and invalidate all data from the L1 Data cache. The SCU duplicate tag RAMs for this core are 
now empty. This prevents any new data cache snoops or data cache maintenance operations from 
other cores in the cluster being issued to this core. 

Disable data coherency with other cores in the cluster, by clearing the CPUECTLR.SMPEN bit. 
Clearing the SMPEN bit enables the core to be taken out of coherency by preventing the core from 
receiving cache or TLB maintenance operations broadcast by other cores in the cluster. 

Execute an ISB instruction to ensure that all of the register changes from the previous steps have been 
committed. 

Execute a DSB SY instruction to ensure that all cache, TLB, and branch predictor maintenance 
operations issued by any core in the cluster device before the SMPEN bit was cleared have 
completed. 

Execute a WFI instruction and wait until the STANDBYWFEFI output is asserted to indicate that the 
core is in idle and low-power state. 

Deassertt DBGPWRDUP LOW. This prevents any external debug access to the core. 

Activate the core output clamps. 


Assert nCPUPORESET LOW. 


10. Remove power from the PDCPU power domain. 
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A4.7 Powering up an individual core 


To power up an individual core, apply the following sequence: 


1. 


2. 


POE 


Assert nCPUPORESET LOW. Ensure DBGPWRDUP is held LOW to prevent any external debug 
access to the core. 

Apply power to the PDCPU power domain. Keep the state of the signals nhCPUPORESET and 
DBGPWRDUP LOW. 

Release the core output clamps. 

Deassert resets. 

Set the CPUECTLR.SMPEN bit to 1 to enable snooping into the core. 

Assert DBGPWRDUP HIGH to allow external debug access to the core. 

If required, use software to restore the state of the core as it was before powerdown. 
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A4.8 Powering down the processor without system driven L2 flush 


When powering down the processor, the PXPDMERCURY, PDL2, and PDCPU power domains are shut 
down and all state is lost. In this section, the lead core is defined as the last core to switch off. 


To power down the processor, apply the following sequence. For device powerdown, all operations on a 
lead core must occur after the equivalent step on all non-lead cores. 


Procedure 


l. 


Ensure all non-lead cores are in shutdown mode, see 44.6 Powering down an individual core 
on page A4-61. 





2. Follow steps / on page A4-61 and 2 on page A4-61 in 44.6 Powering down an individual core 
on page A4-61. 

3. Ifthe ACP interface is configured, ensure that any master connected to the interface does not send 
new transactions, then assert AINACTS. 

4. Clean and invalidate all data from the L2 Data cache. 

5. Follow steps 3 on page A4-61 to /0 on page A4-61 in 44.6 Powering down an individual core 
on page A4-61. 

6. Inan ACE configuration, assert ACINACTM or, in a CHI configuration, assert SINACT. Then, wait 
until the STANDBY WFIL2 output is asserted to indicate that the L2 memory system is idle. All 
Cortex-A35 processor implementations contain an L2 memory system, including implementations 
without an L2 cache. This applies to implementations that use the mini-SCU and implementations 
that use the SCU. 

7. Activate the cluster output clamps. 

8. Remove power from the PDMERCURY and PDL2 power domains. 
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A4.9 Powering up the processor without system driven L2 flush 


When powering down the processor, the PXPDMERCURY, PDL2, and PDCPU power domains are shut 
down and all state is lost. 


To power up the processor, apply the following sequence: 


Procedure 


l. 
2: 
3. 


For each core in the cluster, assert nCPUPORESET LOW. 
Assert nL2ZRESET LOW and hold L2ZRSTDISABLE LOW. 


Apply power to the PDMERCURY and PDL2 domains while keeping the signals described in steps / 
on page A4-64 and 2 on page A4-64 LOW. 


Release the cluster output clamps. 


Continue a normal cold reset sequence. 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights A4-64 


reserved. 
Non-Confidential 


A4 Power Management 
A4.10 Powering down the processor with system driven L2 flush 


A4.10 Powering down the processor with system driven L2 flush 


When powering down the processor, the PXDMERCURY, PDL2, and PDCPU power domains are shut 
down and all state is lost. 


To power down the cluster, apply the following sequence: 





Procedure 

1. Ensure all cores are in shutdown mode, see 44.6 Powering down an individual core on page A4-61. 

2. If the ACP interface is configured, ensure that any master connected to the interface does not send 
new transactions, then assert AINACTS. This is necessary to prevent ACP transactions from 
allocating new entries in the L2 cache while the hardware cache flush is occurring. 

3. Assert LAFLUSHREQ HIGH. 

4. Hold L2FLUSHREQ HIGH until LAFLUSHDONE is asserted. 

5. Deassert LAFLUSHREQ. 

6. In an ACE configuration, assert ACINACTM or, in a CHI configuration, assert SINACT. Then, wait 
until the STANDBY WFIL2 output is asserted to indicate that the L2 memory system is idle. All 
Cortex-A35 processor implementations contain an L2 memory system, including implementations 
without an L2 cache. This applies to implementations that use the mini-SCU and implementations 
that use the SCU. 

7. Activate the cluster output clamps. 

8. Remove power from the PDMERCURY and PDL2 power domains. 
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A4.11 Powering up the processor with system driven L2 flush 


To power up the processor, apply the following sequence: 


Procedure 
1. For each core in the cluster, assert nCPUPORESET LOW. 
2. Assert nLZRESET LOW and hold L2ZRSTDISABLE LOW. 


3. Apply power to the PDMERCURY and PDL2 domains while keeping the signals described in steps / 
on page A4-66 and 2 on page A4-66 LOW. 


4. Release the cluster output clamps. 


5. Continue a normal cold reset sequence. 
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A4.12 Entering Dormant mode 
The processor can enter Dormant mode if certain requirements are met. 


To support Dormant mode, you must ensure: 

¢ That the L2 cache RAMs are in a separate power domain. 

e That all inputs to the L2 cache RAMs are clamped to benign values. This avoids corrupting data 
when the cores and L2 control power domains enter and exit power down state. 


Before entering Dormant mode, the architectural state of the cluster, excluding the contents of the L2 
cache RAMs that remain powered up, must be saved to external memory. 


To enter Dormant mode, apply the following sequence: 


Procedure 

1. Disable the data cache by clearing the SCTLR.C bit, or the HSCTLR.C bit if in Hyp mode. This 
prevents more data cache allocations and causes cacheable memory attributes to change to Normal 
Non-cacheable. Subsequent loads and stores do not access the L1 or L2 caches. 

2. Clean and invalidate all data from the L1 Data cache. The SCU duplicate tag RAM for this core is 
now empty. This prevents any new data cache snoops or data cache maintenance operations from 
other cores in the cluster being issued to this core. 

3. Disable data coherency with other cores in the cluster, by clearing the CPUECTLR.SMPEN bit. 
Clearing the SMPEN bit enables the core to be taken out of coherency by preventing the core from 
receiving cache or TLB maintenance operations broadcast by other cores in the cluster. 

4. Save architectural state, if required. These state saving operations must ensure that the following 
occur: 


e All ARM registers, including the CPSR and SPSR, are saved. 
e All system registers are saved. 
e All debug related state is saved. 


5. Execute an ISB instruction to ensure that all of the register changes from the previous steps have been 
committed. 


6. Execute a DSB instruction to ensure that all cache, TLB, and branch predictor maintenance operations 
issued by any core in the cluster before the SMPEN bit was cleared have completed. In addition, this 
ensures that all state saving has completed. 


7. Execute a WFI instruction and wait until the STANDBYWFI output is asserted, to indicate that the 
core is in idle and low-power state. 

8. Repeat the previous steps for all cores, and wait for all STANDBYWFI outputs to be asserted. 

9. If the ACP interface is configured, ensure that any master connected to the interface does not send 
new transactions, then assert AINACTS. 


10. If ACE is implemented, the SoC asserts the input pin ACINACTM to idle the AXI master interface 
after all snoop transactions have been sent on the interface. If CHI is implemented, the SoC asserts 
the input pin SINACT. 


When the L2 has completed the outstanding transactions for the AXI master and slave interfaces, 
STANDBYWFIL2 is asserted to indicate that L2 memory system is idle. All Cortex-A35 processor 
implementations contain an L2 memory system, including implementations without an L2 cache. 


. When STANDBYWFI and STANDBYWFIL2 are asserted for all cores, the cluster is ready to enter 
Dormant mode. This applies to implementations that use the mini-SCU as well as implementations 
that use the SCU. 


12. Activate the L2 cache RAM input clamps. 
13. Remove power from the PDCPU and PDMERCURY power domains. 


— 
=n 
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A4.13 Exiting Dormant mode 


As part of the exit from Dormant mode to Normal state, the SoC must perform a cold reset sequence. 
The SoC must assert the reset signals until power is restored. After power is restored, the cluster exits the 
cold reset sequence, and the architectural state must be restored. 


To exit Dormant mode, apply the following sequence: 

1. Apply a normal cold reset sequence. You must apply resets to the cores and the L2 memory system 
logic until power is restored. During this reset sequence, L2RSTDISABLE must be held HIGH to 
disable the L2 cache hardware reset mechanism. 

2. When power has been restored, release the L2 cache RAM input clamps. 

Continue a normal cold reset sequence with LARSTDISABLE held HIGH. 

4. The architectural state must be restored, if required. 


ww 
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A4.14 Event communication using WFE or SEV 


An external agent can use the EVENTI pin to participate in a WFE or SEV event communication with 
the Cortex-A35 processor. 


When this pin is asserted, it sends an event message to all the cores in the device. This is similar to 
executing a SEV instruction on one core in the cluster. This enables the external agent to signal to the 
cores that it has released a semaphore and that the cores can leave the WFE low-power state. The 
EVENTI input pin must remain HIGH for at least one CLKIN clock cycle to be visible by the cores. 


The external agent can determine that at least one of the cores in the cluster has executed an SEV 
instruction by checking the EVENTO pin. When SEV is executed by any of the cores in the cluster, an 
event is signaled to all the cores in the device, and the EVENTO pin is asserted. This pin is asserted 
HIGH for three CLKIN clock cycles when any core in the cluster executes an SEV instruction. 
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A4.15 Communication to the Power Management Controller 


Communication between the Cortex-A35 processor and the system power management controller can be 
performed using one or both of the: 


e A4.16 STANDBYWFI[3:0] and STANDBYWFIL2 signals on page A4-71. 
e A4.17 Q-channel on page A4-72. 
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A4.16 STANDBYWFI[3:0] and STANDBYWFIL2 signals 


The STANDBYWEFI[n] signal indicates when an individual core is in idle and low-power state. The 
power management controller can remove power from an individual core when STANDBYWFI[n] is 
asserted. 


The STANDBY WFIL2 signal indicates when all individual cores and the L2 memory system are in idle 
and low-power state. A power management controller can remove power from the Cortex-A35 processor 
when STANDBYWFIL2 is asserted. See 44.8 Powering down the processor without system driven L2 
flush on page A4-63 and A4.10 Powering down the processor with system driven L2 flush on page A4-65 
for more information. 


The Cortex-A35 processor includes a minimal L2 memory system in configurations without an L2 cache. 
Therefore, the power management controller must always wait for assertion of STANDBYWFIL2 
before removing power from the Cortex-A35 processor. This applies to configurations that use the mini- 
SCU and configurations that use the SCU. 


The following figure shows how STANDBYWFI[3:0] and STANDBYWFIL2 correspond to individual 
cores and the Cortex-A35 processor. 
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Figure A4-4 STANDBYWFI[3:0] and STANDBYWFIL2 signals 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights A4-71 
reserved. 
Non-Confidential 


A4 Power Management 
A4.17 Q-channel 


A4.17  Q-channel 


Q-channel enables: 


e The controller to manage entry to, and exit from, a device quiescent state. Quiescence management is 
typically of, but not restricted to, clock gated, and power gated retention states, of the device or 
device partitions. 

e The capability to indicate a requirement for exit from the quiescent state. The associated signaling 
can contain contributions from other devices in the same power domain. 

e Optional device capability to deny a quiescence request. 

e Safe asynchronous interfacing across clock domains. 


For more information, see the Low Power Interface Specification: ARM Q-Channel and P-Channel 
Interfaces. 
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Chapter A5 
Cache Behavior and Cache Protection 


This chapter describes the CPU and SCU cache protection features of the Cortex-A35 processor. 


It contains the following sections: 

e A5.1 Cached memory types on page A5-74. 

e A5.2 Coherency between data caches with the MOESI protocol on page A5-75. 

e A5.3 Cache misses, unexpected cache hits, and speculative fetches on page A5-76. 
e A5.4 Disabling a cache on page AS-77. 

e A5.5 Invalidating or cleaning a cache on page A5-78. 

e A5.6 About read allocate mode on page A5-79. 

e A5.7 About cache protection on page A5-80. 

e 45.8 Error reporting on page A5-82. 

e A5.9 Error injection on page A5-83. 
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A5 Cache Behavior and Cache Protection 
A5.1 Cached memory types 


A5.1 Cached memory types 


The processor can cache data and instructions that meet certain memory attribute criteria. 


L1 instruction cache 


In AArch32 state, when the L1 instruction cache is enabled it caches the following memory 
types: 

¢« Normal, Inner Write-Back. 

e Normal, Inner Write-Through. 


In AArch64 state, when the L1 instruction cache is enabled it caches the following memory 
types: 

¢« Normal, Inner Write-Back. 

e Normal, Inner Write-Through. 

¢« Normal, Inner Non-Cacheable. 


In AArch64 state, disabling the cache has no effect. 


L1 data cache 


When the L1 data cache is enabled, it can cache the following memory types: 
¢« Normal, Inner Write-Back, Outer Write-Back. 


Data might not be allocated if: 

e The data is for a non-temporal load. 

¢ The data is for a DC ZVA instruction. 
¢ The transient hint is set. 

e The no-allocate hint is set. 

e The processor is in read allocate mode. 


L2 cache 


If the L2 cache is present and enabled, it can cache the following memory types: 
¢ Normal, Inner Write-Back, Outer Write-Back. 


Instruction cache lines are allocated into the L2 cache when they are fetched from the external 
memory system. 


Data cache lines are allocated into the L2 cache when they are evicted from an L1 data cache. 


Related information 
B1.42 CPU Auxiliary Control Register on page B1-198. 
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A5 Cache Behavior and Cache Protection 
A5.2 Coherency between data caches with the MOESI protocol 


A5.2 Coherency between data caches with the MOESI protocol 


The processor uses the MOESI protocol to maintain data cache coherency between multiple cores. The 
DCU stores the MOESI state of the cache line in the tag and dirty RAMs. 


MOESI describes the state in which a shareable line can be in an L1 data cache. 


Table A5-1 MOESI and AMBA mapping 





MOESI |AMBA Description 





Modified | UniqueDirty | The line is in only this cache and is dirty. 





Owned | SharedDirty | The line is possibly in more than one cache and is dirty. 





Exclusive | UniqueClean | The line is in only this cache and is clean. 





Shared SharedClean | The line is possibly in more than one cache and is clean. 





Invalid Invalid The line is not in this cache. 

















Data coherency is enabled only when the CPUECTLR.SMPEN bit is set. You must set the SMPEN bit 
before enabling the data cache. If you do not, then the cache is not coherent with other cores and data 
corruption could occur. 


Related information 

45.6 About read allocate mode on page A5-79. 

B1.43 CPU Extended Control Register on page B1-202. 

C5.3 Encoding for tag and data in the LI data cache on page C5-584. 
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A5 Cache Behavior and Cache Protection 
A5.3 Cache misses, unexpected cache hits, and speculative fetches 


A5.3 Cache misses, unexpected cache hits, and speculative fetches 


The L1 and L2 caches handle problematic cache accesses in predefined ways. 


Cache miss 


On a cache miss, the processor performs Critical Word First filling of the cache. 


Unexpected cache hits 

If the cache reports a hit on a memory location that is marked as Non-Cacheable or Device, this is called 
an unexpected cache hit. In this architecturally UNPREDICTABLE case, the cache might return incorrect data 
because of the following configurations or settings: 


e Improper translation table configuration because the caches are physically addressed. 
e The cache is disabled. 


Non-Cacheable or Device accesses do not use the result of a cache lookup and therefore ignore any 
unexpected cache hit. 


Speculative fetches 


Because there can be several unresolved branches in the pipeline, there is no guarantee that the processor 
executes an instruction. Instruction fetches are therefore speculative. A branch or exceptional instruction 
in the code stream can cause a pipeline flush and discard the fetched instructions. Because of the 
prefetching behavior, you must not place read-sensitive devices in the same page as code. Pages with 
Device memory type attributes are treated as Non-Cacheable Normal Memory when accessed by 
instruction fetches. You must use the XN (Execute Never) bit in the page table descriptor for a memory 
region to stop speculative instructions fetches when such memory region contains read-sensitive devices. 
To avoid speculative fetches to read-sensitive devices when address translation is disabled, these devices 
must be separated from code in the physical memory map. 


Related information 
ARM® Architecture Reference Manual ARMV68, for ARMv8-A architecture profile. 
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A5 Cache Behavior and Cache Protection 
A5.4 Disabling a cache 


A5.4 Disabling a cache 


In the AArch64 execution state, disabling the instruction cache has no effect. Fetches continue to be 
cached and cache maintenance operations execute normally. 


In the AArch32 execution state, when the instruction cache is disabled: 


e Fetches cannot access any of the instruction cache arrays. 

e Instruction cache maintenance operations can still execute normally. 

e All instruction fetches to cacheable memory are treated as if they were non-cacheable. This means 
that instruction fetches might not be coherent with caches in other cores and software must take 
account of this. 


When the data cache is disabled: 


¢ Load and store instructions do not access any of the L2 or L1 data cache arrays. 

e Data cache maintenance operations can still execute normally. 

e All load and store instructions to cacheable memory are treated as if they were non-cacheable. It 
means that they are not coherent with the caches in this core or the caches in other cores and software 
must take account of this. 


You cannot disable the L2 and L1 data caches independently because the same enable bit controls them. 


Related information 
B1.105 System Control Register on page B1-319. 
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A5 Cache Behavior and Cache Protection 
A5.5 Invalidating or cleaning a cache 


A5.5 Invalidating or cleaning a cache 


The processor automatically invalidates caches on reset unless suppressed with the 
DBGL1RSTDISABLE or L2RSTDISABLE pins. It is therefore not necessary for software to 
invalidate the caches on start-up. 


DCIMVAC operations in AArch32 and DC IVAC instructions in AArch64 perform an invalidate of the 
target address. If the data is dirty within the cluster then a clean is performed before the invalidate. 


DCISW operations in AArch32 and DC ISW instructions in AArch64 perform both a clean and 
invalidate of the target set/way. The values of HCR.SWIO and HCR_EL2.SWIO have no effect. 


The ARMv8-A architecture does not support an operation to invalidate the entire data cache. If this 
function is required in software, it must be constructed by iterating over the cache geometry and 
executing a series of individual invalidate by set/way instructions. 
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A5 Cache Behavior and Cache Protection 
A5.6 About read allocate mode 


A5.6 About read allocate mode 


The processor supports read allocate mode, also called write streaming mode, both for the L1 and the L2 
cache. 


Read allocate mode is a performance and power-saving optimization for writing a large block of data. 


Read allocate mode for the L1 data cache 


The L1 data cache supports only a Write-Back policy. It normally allocates a cache line on either a read 
miss or a write miss, although you can alter this by changing the inner cache allocation hints in the page 
tables. However, there are some situations where allocating on writes is not wanted, such as executing 
the C standard library memset () function to set a large block of memory to a known value. Writing large 
blocks of data like this can pollute the cache with unnecessary data. It can also waste power and reduce 
performance if a linefill must be performed only to discard the linefill data because the entire line was 
subsequently written by the memset() function. Therefore, the core includes logic to detect when the 
processor has written a full cache line before the linefill completed. If this situation is detected on a 
threshold number of consecutive linefills, the core switches to read allocate mode. 


When the L1 data cache is in read allocate mode: 
¢ Loads behave as normal and can still cause linefills. 
e Writes still look up in the cache but if they miss, they write out to L2 rather than starting a linefill. 


More than the specified number of linefills might be observed on the master interface, before the core 
detects that three full cache lines have been written and switches to read allocate mode. 


The core continues in read allocate mode until it detects either a cacheable write burst to L2 that is not a 
full cache line, or there is a load to the same line as is currently being written to L2. 


To configure the L1 read allocate mode threshold, use CPUACTLR_EL1.LIRADIS in AArch64 state 
and CPUACTLR.LIRADIS in AArch32 state. 


Read allocate mode for the L2 cache 


The L2 cache enters read allocate mode after a threshold number of consecutive cache line sized writes 
to L2 are detected. 


When the L2 cache is in read allocate mode: 
e Loads behave as normal and can still cause linefills. 
e Writes still lookup in the cache but if they miss, they write out to L3 rather than starting a linefill. 


L2 read allocate mode continues until there is a cacheable write burst that is not a full cache line, or there 
is a load to the same line as is currently being written to L3. 


To configure the L2 read allocate mode threshold, use CPUACTLR_EL2.RADIS in AArch64 state and 
CPUACTLR.RADIS in AArch32 state. 


Related information 
B1.42 CPU Auxiliary Control Register on page B1-198. 
B2.36 CPU Auxiliary Control Register, ELI on page B2-400. 
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A5 Cache Behavior and Cache Protection 
A5.7 About cache protection 


A5.7 About cache protection 


The processor protects against soft errors that result in a RAM bitcell temporarily holding the incorrect 
value, by writing a new value to the RAM to correct the error. If the error is a hard error that is not 
corrected by writing to the RAM, for example a physical defect in the RAM, then the processor might 
get into a livelock because it continually detects and then tries to correct the error. 


Some RAMs have Single Error Detect (SED) capability, others have Single Error Correct, Double Error 
Detect (SECDED) capability. The L1 data cache dirty RAM is Single Error Detect, Single Error Correct 
(SEDSEC). The processor can make progress and remain functionally correct when there is a single bit 
error in any RAM. If there are multiple single bit errors in different RAMs or within different protection 
granules within the same RAM, then the processor also remains functionally correct. 


If there is a double bit error in a single RAM within the same protection granule, then the behavior 
depends on the RAM: 


e For RAMs with SECDED capability, the processor detects and reports the error. If the error is in a 
cache line that contains dirty data, that data might be lost, which then causes data corruption. 

e For RAMs with only SED, the processor does not detect a double bit error. This might cause data 
corruption. 


If there are three or more bit errors the processor might or might not detect the errors, depending on the 
RAM and the position of the errors within the RAM. 


The cache protection feature of the processor has a minimal performance impact when no errors are 
present. When the processor detects an error, it stalls the access that caused the error while it corrects the 
error. When the correction is complete, the access either continues with the corrected data or is retried. If 
the access is retried, it either hits in the cache again with the corrected data or misses in the cache and re- 
fetches the data from a lower level cache or from main memory. 


Table A5-2 Cache protection behavior of each RAM 








cache tag 


RAM Protection Configuration option Protection Correction behavior 
type granule 
L1 instruction | Parity, SED CPU_CACHE PROTECTION | 31 bits The processor invalidates both lines in the cache 


set then refetches the requested line from the L2 





L1 instruction 


he or external l 
Parity, SED | CPU_CACHE PROTECTION | 18 bits Pea R O ee SNE 








tag 


cache data 

TLB Parity, SED CPU_CACHE_PROTECTION |31 bits or 51 The processor invalidates the entry and starts a 
bits new pagewalk to refetch it. 

L1 data cache | Parity, SED CPU _ CACHE_PROTECTION | 32 bits The processor cleans the line and invalidates it 











from the L1 cache. It uses SCU duplicate tags to 
get the correct address. It refetches the line from 
the L2 cache or external memory. 





L1 data cache 
data 


ECC, SECDED | CPU _ CACHE PROTECTION | 32 bits The processor cleans the line and invalidates it 
from the L1 cache. It corrects single bit errors as 
part of the eviction. It refetches the line from the 
L2 cache or external memory. 





L1 data cache 
dirty 








Parity, CPU_CACHE_PROTECTION | 1 bit The processor cleans the line and invalidates it 
SEDSEC from the L1 cache. It corrects single bit errors as 
part of the eviction. 


Only the dirty bit is protected. The other bits are 
performance hints, therefore do not cause a 
functional failure if they are incorrect. 
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A5 Cache Behavior and Cache Protection 
A5.7 About cache protection 


Table A5-2 Cache protection behavior of each RAM (continued) 




















RAM Protection Configuration option Protection Correction behavior 

type granule 

SCU L1 ECC, SECDED | CPU_CACHE PROTECTION | 33 bits The processor rewrites the tag with the correct 

duplicate tag value and retries access. If the error is 

table then th invalidates th 

L2 tag ECC, SECDED | SCU_CACHE PROTECTION | 32 bits eo able then ttig processor ihvalidates thig 

L2 victim None - - The victim RAM only serves as a performance 
hint. It does not result in a functional failure if 
the contents are incorrect. 

L2 data ECC, SECDED | SCU_CACHE_PROTECTION | 64 bits The processor corrects the data inline and might 
stall access for an additional cycle or two while 
the correction takes place. After correction, the 
processor might evict the line. 




















If a correctable ECC error occurs after the first data cache access of a load instruction that takes multiple 

cycles to complete, and if one of the following conditions has taken place: 

e A hardware breakpoint, watchpoint, or vector catch has been set since the first execution that is 
triggered on re-execution. 

e The page tables have been modified since the first execution. This resulted in an instruction or data 
abort trap being taken on re-execution. 


then the register file is updated with data that was successfully read before the correctable ECC error 


occurred. 
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A5 Cache Behavior and Cache Protection 
A5.8 Error reporting 


A5.8 Error reporting 


The processor reports detected errors, including errors that are successfully corrected and those that 
cannot be corrected, in the CPUMERRSR or L2MERRSR registers. It also signals them on the 
PMUEVENT bus. 


If multiple errors occur on the same clock cycle then only one of them is reported. Errors that cannot be 
corrected, and therefore might result in data corruption, also cause an abort or external pin to be asserted, 
so that software can be aware that there is an error and can either attempt to recover or can restart the 
system. Such errors are: 


e Uncorrectable errors in the L2 data RAM when read by an instruction fetch, TLB pagewalk, or load 

instruction, might result in a precise data abort or prefetch abort. 

e Uncorrectable errors in the L2 data RAM when read by a fetch into the L1 data cache from a load, 

store or preload instruction, or by the hardware prefetcher, might result in an asynchronous exception. 

e Uncorrectable errors in the L1 or L2 data RAMs when the line is being evicted from a cache results 

in the processor asserting the nINTERRIRQ signal. This might be because of a natural eviction, a 

cache maintenance operation, or a snoop. 

e Uncorrectable errors in the L2 tag RAMs or SCU L1 duplicate tag RAMs result in the processor 
asserting the nINTERRIRQ signal. 


e When nINTERRIRQ is asserted it remains asserted until the error is cleared by a write of 0 to the L2 
internal asynchronous error bit of the LZECTLR register. 

e ARM recommends that the nINTERRIRQ signal is connected to the interrupt controller so that an 
interrupt or system error is generated when the signal is asserted. 





When a dirty cache line with an error on the data RAMs is evicted from the processor, the write on the 
master interface still takes place, however if the error is uncorrectable then: 


e On AXI and ACE, the write strobes are not set, therefore the incorrect data is not written externally. 
e On CHI, the strobes are set, but the response field indicates that there is a data error. 


When a snoop hits on a line with an uncorrectable data error the data is returned, if required by the 
snoop, but the snoop response indicates that there is an error. 


If a snoop hits on a tag that has an uncorrectable error, then it is treated as a snoop miss, because the error 
means that it is unknown if the cache line is valid or not. 


In some cases it is possible for an error to be counted more than once. For example, multiple accesses 
might read the location with the error before the line is evicted as part of the correction process. 


Related references 

B1.44 CPU Memory Error Syndrome Register on page B1-204. 
B1.93 L2 Extended Control Register on page B1-293. 

B1.94 L2 Memory Error Syndrome Register on page B1-295. 
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A5 Cache Behavior and Cache Protection 
A5.9 Error injection 


A5.9 Error injection 


To support testing of error handling software, the processor provides the capability to force double-bit 
errors to be injected into the L1 D-cache data RAMs, the L2 data RAMs, and the L2 tag RAMs. 


Error injection on the L1 D-cache data RAMs is enabled by setting the CPUACTLR.L1DEIEN bit. 
While this bit is set, double-bit errors are injected on all writes to the L1 D-cache data RAMs for the first 
word of each 32-byte region. This corresponds to bytes with an address where bits [4:2] are bogo. The 
L1 D-cache RAMs can be written to because of: 


e Explicit stores from the core. 
e Cache line fetches into the cache, as a result of: 
— Load instructions. 
— Store instructions. 
— Preload instructions. 
— Data prefetches. 
— Pagewalks. 


Error injection on the L2 data RAMs is enabled by setting the LAACTLR.L2DEIEN bit. While this bit is 
set, double-bit errors are injected on all writes to the L2 cache data RAMs. The L2 data RAMs can be 
written to because of: 


e Explicit stores from one of the cores. 
e Instruction fetches or prefetches. 

e Evictions from the L1 Data cache. 

e ACP accesses. 


Error injection on the L2 tag RAMs is enabled by setting the LZAACTLR.L2TEIEN bit. While this bit is 
set, double-bit errors are injected on all writes to the L2 tag RAMs. The L2 cache tag RAMs can be 
written because of: 

e Explicit stores from one of the cores. 

e 2 allocations caused by instruction fetches or prefetches. 

e Evictions from the L1 Data cache. 

e ACP accesses. 

e Snoop operations. 

e Cache maintenance instructions. 
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AS Cache Behavior and Cache Protection 
A5.9 Error injection 
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Chapter A6 
L1 Memory System 


This chapter describes the L1 instruction cache and data cache. 


It contains the following sections: 

e A6.1 About the LI memory system on page A6-86. 

e A6.2 TLB Organization on page A6-87. 

e A6.3 Program flow prediction on page A6-88. 

e A6.4 About the internal exclusive monitor on page A6-89. 
e A6.5 About data prefetching on page A6-91. 
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A6 L1 Memory System 
A6.1 About the L1 memory system 


A6.1 About the L1 memory system 


The L1 memory system includes several power-saving and performance-enhancing features. These 
include separate instruction and data caches, which can be configured independently during 
implementation to sizes of 8KB, 16KB, 32KB, or 64KB. 


MMU 


The MMU provides fine-grained memory system control through a set of virtual-to-physical 
address mappings and memory attributes held in translation tables. These are loaded into the 
Translation Lookaside Buffer (TLB) when a location is accessed. The key features are: 


10-entry fully-associative instruction micro TLB. 
10-entry fully-associative data micro TLB. 

2-way set-associative 512-entry unified main TLB. 
2-way set-associative 64-entry walk cache. 

2-way set-associative 64-entry IPA cache. 


L1 instruction-side memory system 
The L1 instruction-side memory system provides an instruction stream to the DPU. The key 
features are: 


A dedicated instruction cache that: 

— is virtually indexed and physically tagged. 

— is 2-way set associative. 

— is configurable to be 8KB, 16KB, 32KB, or 64KB. 
— uses a cache line length of 64 bytes. 

— uses a pseudo-random replacement policy. 

A 128-bit read interface to the L2 memory system. 
Dynamic program flow prediction. 


L1 data-side memory system 
The L1 data-side memory system responds to load and store requests from the DPU. It also 
responds to snoop requests that have been forwarded by the SCU from other cores or external 
masters. The key features are: 


A dedicated data cache that: 

— is physically indexed and physically tagged. 

— is 4-way set associative. 

— is configurable to be 8KB, 16KB, 32KB, or 64KB. 

— uses a cache line length of 64 bytes. 

— uses a pseudo-random replacement policy. 

A 128-bit read and 256-bit write interface to the L2 memory system. 
A 64-bit read and 64-bit write path to the DPU. 

Read buffers that service the DCU, the IFU, and the TLB. 
Support for three outstanding data cache misses. 

Support for eight outstanding linefill requests. 

A merging store buffer. 

An internal exclusive monitor. 

An automatic data prefetch engine. 

Write stream detection and optimization (read allocate mode). 


Related information 

A6.4 About the internal exclusive monitor on page A6-89. 
46.5 About data prefetching on page A6-91. 

A5.6 About read allocate mode on page A5-79. 
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A6 L1 Memory System 
A6.2 TLB Organization 


A6.2 TLB Organization 


This section describes the organization of the TLB. 


Micro TLB 


The first level of caching for the translation table information is a micro TLB of ten entries that 
is implemented on each of the instruction and data sides. All main TLB related maintenance 
operations result in flushing both the instruction and data micro TLB. 


Main TLB 


A unified main TLB handles misses from the micro TLBs. It has a 512-entry, 2-way, set- 
associative structure and supports all VMSAv8 block sizes, except 1GB. If it fetches a 1GB 
block, the TLB splits it into 512MB blocks and stores the appropriate block for the lookup. 
Accesses to the main TLB take a variable number of cycles. The number of cycles depends on 
the following criteria: 

e Competing requests from each of the micro TLBs. 

e The TLB maintenance operations in flight. 

e The different page size mappings in use. 


IPA cache RAM 


The Jntermediate Physical Address (IPA) cache RAM holds mappings between intermediate 
physical addresses and physical addresses. Only Non-secure EL1 and ELO stage 2 translations 
use this cache. When a stage 2 translation is completed, it is updated and checked whenever a 
stage 2 translation is required. 


Similarly to the main TLB, the IPA cache RAM can hold entries for different sizes. 


Walk cache RAM 


The walk cache RAM holds the result of a stage 1 translation up to but not including the last 
level. If the stage 1 translation results in a section or larger mapping then nothing is placed in the 
walk cache. 


The walk cache holds entries fetched from Secure and Non-secure state. 
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A6 L1 Memory System 
A6.3 Program flow prediction 


A6.3 Program flow prediction 


Program flow prediction is always enabled when the MMU is enabled by setting the appropriate control 
bit in the relevant system control register. 


As a general rule, the flow prediction hardware predicts all branch outcomes regardless of the addressing 
mode. For example, it predicts the outcomes of the following branch types: 


e Conditional branches. 

e Unconditional branches. 

e Indirect branches that are associated with procedure call and return instructions. 
¢ Branches that switch between A32 and T32 states. 


However, the flow prediction hardware does not predict the branch outcomes for the following 
instructions: 


e Data-processing instructions that use the PC as a destination register. 
e The BX instruction. 
¢ Exception return instructions. 


A T32 instruction set branch that is normally encoded as unconditional can be made conditional by 
inclusion in an /f-Then (IT) block. Then it is treated as a conditional branch. 


Return stack predictions 


The return stack stores the return address and, in AArch32, the A32 or T32 instruction set of the 
instruction after a procedure call type branch instruction. This address is equal to the link register value 
stored in r14 in AArch32 state or X30 in AArch64 state. The following instructions cause a return stack 
push if predicted: 

e BL. 

° BLX (immediate) in AArch3?2 state. 

e BLX (register) in AArch32 state. 

° BLR in AArch6é4 state. 


In AArch32 state, the following instructions cause a return stack pop if predicted: 


e BX 

e LDR pc, [r13], #imm 
e LDM r13, {..pc} 

e LDM r13, {..pc}! 


In AArch64 state, the RET instruction causes a return stack pop. 


Because return-from-exception instructions can change processor privilege mode and security state, they 
are not predicted. This includes: 
e LDM (exception return) 


e RFE 
e SUBS pc, Ir 
e  ERET 


Related information 

B1.105 System Control Register on page B1-319. 
B2.90 System Control Register, ELI on page B2-506. 
B2.91 System Control Register, EL2 on page B2-510. 
B2.92 System Control Register, EL3 on page B2-512. 
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A6.4 About the internal exclusive monitor 


A6.4 About the internal exclusive monitor 


The internal exclusive monitor is a state machine that manages Load-Exclusive or Store-Exclusive 
instructions, and Clear-Exclusive (CLREX) instructions. Its two states are open and exclusive. 


You can use the Load-Exclusive or Store-Exclusive accesses and the Clear-Exclusive instructions to 
construct semaphores to ensure synchronization between different processes running on the core and also 
between different cores that are using the same coherent memory locations for the semaphore. 


A Load-Exclusive instruction tags a small block of memory for exclusive access. The size of the tagged 
block is defined by CTR.ERG as 16 words, one cache line. 


A Load-exclusive/Store-exclusive instruction is any one of the following: 


e In the A64 instruction set, any instruction that has a mnemonic starting with LDX, LDAX, STX, or STLX. 
¢ Inthe A32 and T32 instruction sets, any instruction that has a mnemonic starting with LDREX, STREX, 
LDAEX, or STLEX. 


A Load-Exclusive instruction that causes a transaction with ARLOCKM for AXI/ACE, or Exel for CHI, 
set to HIGH is expected to receive an EXOKAY response. An OKAY response to a transaction with 
ARLOCKM for AXI/ACE, or Excl for CHI, set to HIGH indicates that exclusive accesses are not 
supported at the address of the transaction and causes a Data Abort exception to be taken with a Data 
Fault Status Code of: 


* @b110101, when using the long descriptor format. 
* @b10101, when using the short descriptor format. 


A Load-Exclusive instruction causes ARLOCKM for AXI to be set to HIGH if the memory attributes 
are: 


e Device. 

¢« Normal Inner Non-cacheable and Outer Non-cacheable. 

e Normal Inner is not Write-Back or Outer is not Write-Back, and Inner Shareable. 
e Normal Inner is not Write-Back or Outer is not Write-Back, and Outer Shareable. 


A Load-Exclusive instruction causes ARLOCKM for ACE or Excl for CHI, to be set to HIGH if the 
memory attributes are: 

e Device. 

¢ Normal Inner Non-cacheable and Outer Non-cacheable. 

e Normal Inner Write-Back, Outer Write-Back, Outer Shareable, and BROADCASTOUTER is set to 
HIGH. 

e Normal Inner Write-Back, Outer Write-Back, Inner Shareable, and BROADCASTINNER is set to 
HIGH. 

e Normal Inner is not Write-Back or Outer is not Write-Back, and Inner Shareable. 

e Normal Inner is not Write-Back or Outer is not Write-Back, and Outer Shareable. 








In cases where there is an intervening store operation between an exclusive load and an exclusive store 
from the same core, the intermediate store does not produce any direct effect on the internal exclusive 
monitor. The local monitor is in the Exclusive Access state after the exclusive load, remains in the 
Exclusive Access state after the store, and returns to the Open Access state only after the exclusive store, 
a CLREX instruction, or an exception return. 


However, if the exclusive code sequence is accessing an address in cacheable memory, any cache line 
eviction that contains that address clears the monitor. ARM therefore recommends that no load or store 
instructions are placed between the exclusive load and the exclusive store because these additional 
instructions can cause a cache eviction. Any data cache maintenance instruction can also clear the 
exclusive monitor. 


Related references 
A&.3 AXI transactions on page A8-104. 
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A6.4 About the internal exclusive monitor 


A9.4 ACE transactions on page A9-113. 
A10.5 CHI transactions on page A10-127. 
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A6.5 About data prefetching 


This section describes the software and hardware data prefetching behavior for the processor. 


Preload instructions 


PLD instructions in AArch32, and PRFM instructions of type PLD in AArch64, look up in the cache and 
start a linefill if they miss and are to a cacheable address. These instructions retire as soon as their linefill 
has started, they do not wait for data to be returned. This enables other instructions to execute while the 
linefill continues in the background. 


PLDW instructions in AArch32, and PRFM instructions of type PST in AArch64, are similar to PLD, except 
that if they miss, the linefill causes data to be invalidated in other cores and masters so that the line is 
ready for writing. 


PRFM instructions also enable targeting of a prefetch to the L2 cache. When this is the case, a request is 
sent to the L2 memory system to start a linefill. The instruction then retires without any data being 
returned to the L1 memory system. 


PLI instructions in AArch32, and PRFM instructions of type PLI in AArch64, are treated as NOPs. 


Automatic data prefetching and monitoring 


The L1 data-side memory system implements an automatic prefetcher that monitors cache misses in the 
core. When a pattern is detected, the automatic prefetcher starts linefills in the background. The 
prefetcher recognizes a sequence of data cache misses at a fixed stride pattern that lies in four cache 
lines, plus or minus. Any intervening stores or loads that hit in the data cache do not interfere with the 
recognition of the cache miss pattern. 


The CPUACTLR enables you to: 


e Deactivate the prefetcher. 
e Alter the sequence length required to trigger the prefetcher. 
e Alter the number of outstanding requests that the prefetcher can make. 


Use PLD or PRFM instructions for data prefetching where short sequences or irregular pattern fetches are 
required. 

Non-temporal loads 

Cache requests made by a non-temporal load instruction (LDNP) are allocated to the L2 cache only. The 
allocation policy makes it likely that the line is replaced sooner than other lines. 

Data Cache Zero 


The Data Cache Zero by Virtual Address (DC ZVA) instruction enables a block of 64 bytes in memory, 
aligned to 64 bytes in size, to be set to zero. If the DC ZVA instruction misses in the cache, it clears main 
memory, without causing an L1 or L2 cache allocation. 


Related information 
B2.36 CPU Auxiliary Control Register, ELI on page B2-400. 
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Chapter A7 
L2 Memory System 


This chapter describes the L2 memory system and the Snoop Control Unit (SCU) that is tightly 
integrated with it. 


It contains the following sections: 

e A7.1 About the L2 memory system on page A7-94. 

¢ 47.2 Snoop and maintenance requests on page A7-96. 

e A7.3 Support for memory types on page A7-97. 

e A7.4 Memory type information exported from the processor on page A7-98. 
¢ A7.5 Handling of external aborts on page A7-99. 
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A7.1 About the L2 memory system 


A7.1 About the L2 memory system 


In most configurations, the L2 memory system consists of an integrated SCU that connects the cores in a 
cluster, an optional, tightly-coupled L2 cache, and an optional ACP interface. In single core, AXI 
configurations that do not include CPU cache protection, ACP, or an L2 cache, the SCU is replaced with 
a more area-efficient mini-SCU. 


The same system register control bit enables the L1 data cache and the L2 cache. 


SCU 


The SCU maintains coherency between the L1 and L2 data caches in the processor. It also 
arbitrates requests for the L2 cache and the AXI, ACE, or CHI master interface. 


A coherent request from a core is one that checks for data in the L1 data caches and, if present, 
the L2 cache. The SCU might send a request to another core to retrieve or invalidate data, or 
both, depending on the type of coherent request. This request is referred to as a snoop request. If 
the processor is implemented with an ACE or CHI master interface then the SCU can issue 
coherent requests on the master interface, which might result in snoop requests being sent to 
other masters in the system. The SCU might also receive snoop requests from other masters. 


The SCU can handle direct cache-to-cache transfers between cores without having to read or 
write any data to the external memory system. Cache line migration enables dirty cache lines to 
be moved between cores, and there is no requirement to write back transferred cache line data to 
the external memory system. 


Each core has tag and dirty RAMs that contain the state of the cache line in the L1 data cache. 
Rather than sending a snoop request to each core to access these for each coherent request, the 
SCU contains a set of duplicate tags that allows it to check the contents of each L1 data cache. 
The duplicate tags filter coherent requests so that a snoop request is only sent to a core if the 
coherent request hits in the corresponding duplicate tags. The duplicate tags are also used to 
filter snoop requests from the external memory system. This allows the cores and the system to 
function efficiently even with a high volume of requests. 


The SCU does not support hardware management of coherency of the instruction caches. 
Instruction cache linefills perform coherent reads, however, there is no coherency management 
of data held in the instruction cache. 


mini-SCU 


The mini-SCU replaces the SCU in certain uniprocessor configurations that do not require data 
cache coherency with other masters in the system. That is, implementations that are configured 
to have a single CPU, no L2 cache, no CPU cache protection, and an AXI interface. The mini- 
SCU bridges between the master interface of the core and the AXI master interface of the 
processor. 
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A7.1 About the L2 memory system 


L2 cache 


ACP 


Data cache lines are allocated to the L2 cache only when evicted from the L1 memory system, 
not when first fetched from the system. The only exceptions to this rule are for memory marked 
with the inner transient hint, or for non-temporal loads that are only ever allocated to the L2 
cache. The L1 cache can prefetch data from the system, without data being evicted from the L2 
cache. 


Instruction cache lines are allocated to the L2 cache when fetched from the system and can be 
invalidated during maintenance operations. 


The L2 cache is 8-way set associative. The L2 cache tags are looked up in parallel with the SCU 
duplicate tags. If both the L2 tag and SCU duplicate tag hit, a read accesses the L2 cache in 
preference to snooping one of the other cores. 


L2 RAMs are invalidated automatically at reset unless the LARSTDISABLE signal is set HIGH 
when the nL2RESET signal is deasserted. 


Further features of the L2 cache are: 

e Configurable size of 128KB, 256KB, 512KB, and 1MB. 
¢ Fixed line length of 64 bytes. 

e Physically indexed and tagged. 

e Optional ECC protection. 

e A pseudo-LRU replacement policy. 


Optional 128-bit wide I/O coherent ACP interface that can allocate to the L2 cache. 


Master memory interface 


The SCU connects the cores to the external memory system through a 128-bit-wide master 
memory interface that uses ACE, CHI, or AXI technology. The memory interface supports 
integer ratios of the processor clock period up to and including 1:1 and a 40-bit physical address 
range. 


The L2 memory system has two abort mechanisms, a synchronous one and an asynchronous one. 


Related information 

A7.5 Handling of external aborts on page A7-99. 
Chapter A9 ACE Master Interface on page A9-109. 
Chapter A10 CHI Master Interface on page A10-121. 
Chapter A8 AXI Master Interface on page A8-101. 
Chapter All ACP Slave Interface on page A11-131. 
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A7 L2 Memory System 
A7.2 Snoop and maintenance requests 


Snoop and maintenance requests 


In implementations that include an ACE or CHI master interface, the SCU controls snoop and 
maintenance requests to the external memory system with the BROADCASTINNER, 
BROADCASTOUTER, and BROADCASTCACHEMAINT configuration inputs. 


Table A7-1 Control pins for snoop and maintenance requests 





Signal 


Setting | Description 





BROADCASTINNER 1 The inner shareability domain extends beyond the processor. Inner Shareable snoop and 


maintenance operations are broadcast externally. 





0 The inner shareability domain does not extend beyond the processor. 





BROADCASTOUTER 1 The outer shareability domain extends beyond the processor. Outer shareable snoop and 


maintenance operations are broadcast externally. 





0 The outer shareability domain does not extend beyond the processor. 








BROADCASTCACHEMAINT 


— 


There are external downstream caches and maintenance operations are broadcast 
externally. 





0 There are no downstream caches external to the processor. 














If you set the BROADCASTINNER pin to HIGH you must also set the BROADCASTOUTER pin to 
HIGH. 


In a system that contains a Cortex-A35 processor and another processor in a big.LITTLE configuration, 
you must ensure the BROADCASTINNER and BROADCASTOUTER pins on both processors are set 
to HIGH so that both processors are in the same Inner Shareable domain. 


Cacheable loads and stores to a shareability domain, that does not extend beyond the processor can 
allocate data to the L1 and L2 caches. However, they do not make coherent requests on the master for 
these accesses. Instead, they use only ReadNoSnoop or WriteNoSnoop transactions. This always 
includes non-shareable memory, and might include inner shareable and outer shareable memory, 
depending on the setting of the BROADCASTINNER and BROADCASTOUTER pins. 


If the system sends a snoop to the Cortex-A35 processor for an address that is present in the L1 or L2 
cache, but the line in the cache is in a shareability domain that does not extend beyond the cluster, then 
the snoop is treated as missing in the cluster. 
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A7.3 Support for memory types 


A7.3 Support for memory types 
The processor simplifies the coherency logic by downgrading some memory types. 


e Memory that is marked as both Inner Write-Back Cacheable and Outer Write-Back Cacheable is 
cached in the L1 data cache and the L2 cache. 

e Memory that is marked Inner Write-Through is downgraded to Non-cacheable. 

e Memory that is marked Outer Write-Through or Outer Non-cacheable is downgraded to Non- 
cacheable, even if the inner attributes are Write-Back cacheable. 


The attributes provided on ARCACHE or AWCACHE in AXI and ACE configurations or MemAttr and 
SnpAttr in CHI configurations are these downgraded attributes and indicate how the interconnect must 
treat the transaction. 
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A7.4 Memory type information exported from the processor 

















A7.4 Memory type information exported from the processor 
The processor makes attribute information about memory types available through signals for 
interconnects or bus protocols that require such information. 
Some interconnects or bus protocols might require more information about the memory type and, for 
these cases, the cluster exports the memory attribute information from the translation tables stored in the 
TLB. These signals are for information only, and do not form part of the AXI, ACE, or CHI protocols. 
¢ Inan AXI or ACE configuration, there is a RDMEMATTR bus for the read channel and a 
WRMEMATTR bus for the write channel. 
e InaCHI configuration, there is a single REQMEMATTR bus. 
Table A7-2 Bus encoding for memory attributes 
Bits Encoding Notes 
[7] Outer shareable. Shareability information is not recorded in the L1 data cache for 
i implementations that use the mini-SCU. WRMEMATTRI7] is @b@ for L1 data 
Always set for device memory or u ; . . 
; : cache evictions in these implementations. 
memory that is both inner and outer 
non-cacheable. 
[6:3] Outer memory type, or device type. If an ARMv7 architecture operating system runs on the processor, the Device 
Rea erage : i memory type matches the nGnRE encoding and the Strongly-Ordered memory 
If bits[1:0] indicate Device, then: type matches the nGnRnE memory type. 
0500ga: nGRF. Outer read allocate hint information is not recorded in the L1 or L2 data caches. 
0b0109 nGnRE. WRMEMATTR[4] and REQMEMATTRIA] are set to @b1 for data cache 
0b1000 nGRE. evictions. 
@b110@ GRE. 
If bits[1:0] indicate Normal, then: 
e@be1ee@ NC. 
@b1eRW WT. 
@b11RW WB. 
Where R is read allocate hint, W is 
write allocate hint. 
[2] Inner shareable. Shareability information is not recorded in the L1 data cache for 
Anything with bit[7] set must also implementations that use the mini-SCU. WRMEMATTR[?] is bð for L1 data 
; cache evictions in these implementations. 
have bit[2] set. 
[1:0] Inner memory type: 
ebee Device. 
@be1 NC. 
0b10 WT. 
@b11 WB. 
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A7.5 Handling of external aborts 


A7.5 Handling of external aborts 


The memory system handles external aborts using the synchronous abort mechanism, asynchronous 
abort mechanism, or the nNEXTERRIRQ pin as described in this section. 


Synchronous abort mechanism 

External aborts on the following accesses use the synchronous abort mechanism. 

e All load accesses. 

e All Store Exclusive accesses (STREX, STREXB, STREXH, STREXD, STXR, STXRB, STXRH, 
STXP, STLXR, STLXRB, STLXRH, and STLXP). 


Asynchronous abort mechanism 

External aborts on the following accesses use the asynchronous abort mechanism. 

e Stores to Device memory (except Store Exclusive accesses). 

e Stores to Normal memory that is Inner Non-cacheable, Inner Write-Through, Outer Non-cacheable, 
or Outer Write-Through (except Store Exclusive accesses). 

e LI data cache and L2 cache linefills that receive data from the interconnect in the dirty state. 


nEXTERRIRQ pin 

External aborts on the following accesses cause the nREXTERRIRQ pin to be asserted because the aborts 
might not relate directly back to a specific core in the cluster. 

e All store accesses to Normal memory that is both Inner write-back and Outer write-back. 

e Evictions from the L1 data cache or L2 cache. 

e DVM Complete transactions. 


Related references 
B1.93 L2 Extended Control Register on page B1-293. 
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Chapter A8 
AXI Master Interface 


This chapter describes the AXI master memory interface. 


It contains the following sections: 

e A8.1 About the AXI master interface on page A8-102. 

¢ A8.2 AXI privilege information on page A8-103. 

°- 48.3 AXI transactions on page A8-104. 

e 48.4 Attributes of the AXI master interface on page A8-106. 
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A8.1 About the AXI master interface 


A8.1 About the AXI master interface 


You can configure the processor to use the AXI protocol for the master memory interface. 


Read responses 


The AXI master can delay accepting a read data channel transfer by holding RREADY LOW for an 
indeterminate number of cycles. RREADY can be deasserted LOW between read data channel transfers 
that form part of the same transaction. 


Write responses 


The AXI master requires that the slave does not return a write response until it has received the write 
address. 


The AXI master always accepts write responses without delay by holding BREADY HIGH. 


Barriers 


You must ensure that your interconnect and any peripherals connected to it do not return a write response 
for a transaction until that transaction would be considered complete by a later barrier. This means that 
the write must be observable to all other masters in the system. ARM expects the majority of peripherals 
to meet this requirement. 


Related information 
A8.2 AXI privilege information on page A8-103. 
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AXI privilege information 


A8 AXI Master Interface 
A8.2 AXI privilege information 


AXI provides information about the privilege level of an access on the ARPROTM[0] and 
AWPROTM[0] signals. However, when accesses might be cached or merged together, the resulting 
transaction can have both privileged and unprivileged data combined. If this happens, the processor 
marks the transaction as privileged, even it if was initiated by an unprivileged process. 


The following table shows exception levels and corresponding ARPROTM[0] and AWPROTM)[0] 


values. 


Table A8-1 ARPROT and AWPROT values 





Processor exception level 


Type of access 


Value of ARPROT[0] and 
AWPROT[0] 





ELO, EL1, EL2, EL3 


Cacheable read access 


Privileged access 





ELO 





ELI, EL2, EL3 


Device, or normal Non-cacheable read access 


Unprivileged access 





Privileged access 





ELO, EL1, EL2, EL3 


Cacheable write access 


Privileged access 




















ELO Device, nGnRnE, nGnRE, and nGRE write Unprivileged access 
EL1, EL2, EL3 Privileged access 
ELO Normal Non-cacheable or Device GRE write, except for STREX, Privileged access 
STREXB, STREXH, STREXD, STXR, STXRB, STXRH, STXP, STLXR, 
STLXRB, STLXRH and STLXP to shareable memory 
ELO Normal Non-cacheable write for STREX, STREXB, STREXH, Unprivileged access 
STREXD, STXR STXRB, STXRH, STXP, STLXR, STLXRB, STLXRH 
and STLXP to shareable memory 
EL1, EL2, EL3 Normal Non-cacheable write Privileged access 





ELO, EL1, EL2, EL3 








TLB pagewalk 





Privileged access 
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A8 AXI Master Interface 
A8.3 AXI transactions 


















































A8.3 AXI transactions 
The processor generates only a subset of all possible AXI transactions on the AXI master interface. 
The processor does not generate any FIXED bursts and all WRAP bursts fetch a complete cache line 
starting with the critical word first. A burst does not cross a cache line boundary. 
The cache linefill fetch length is always 64 bytes. 
For WriteBack transfers the supported transfers are: 
e WRAP 4 128-bit for read transfers (linefills). 
e INCR 4 128-bit for write transfers (evictions). 
e INCRN (N:1, 2, or 4) 128-bit write transfers (read allocate). 
For Non-cacheable transactions: 
e WRAP 4 128-bit for read transfers. 
e INCRN (N:1, 2, or 4) 128-bit for write transfers. 
e INCRN (N:1, 2, or 4) 128-bit for read transfers. 
e INCR 1 32-bit, 64-bit, and 128-bit for read transfers. 
e INCR 1 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit for write transfers. 
e INCR 1 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit for exclusive write transfers. 
e INCR 1 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit for exclusive read transfers. 
For Device transactions: 
e INCRN (N:1, 2, or 4) 128-bit read transfers. 
e INCRN (N:1, 2, or 4) 128-bit write transfers. 
e INCR 1 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit read transfers. 
e INCR 1 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit write transfers. 
e INCR 1 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit exclusive read transfers. 
e INCR 1 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit exclusive write transfers. 
For translation table walk transactions INCR 1 32-bit, and 64-bit read transfers. 
The following points apply to AXI transactions: 
e WRAP bursts are only 128-bit. 
e INCR 1 can be any size for read or write. 
e INCR burst, more than one transfer, are only 128-bit. 
e No transaction is marked as FIXED. 
e Write transfers with none, some, or all byte strobes LOW can occur. 
External memory accesses generate the following transactions in an implementation configured with an 
AXI master interface. 
Table A8-2 AXI transactions 
Attributes AXI transaction 
Memory type Shareability | Load | Store | Load exclusive Store exclusive 
Device - Read | Write | Read with Write with AWLOCKM 
ARLOCKM set HIGH | set HIGH 
Normal, inner Non-cacheable, outer Non- Non-shared Read | Write | Read Write 
eee Inner-shared Read with Write with ARLOCKM set 
ARLOCKM set HIGH | HIGH 
Outer-shared 
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A8 AXI Master Interface 
A8.3 AXI transactions 


Table A8-2 AXI transactions (continued) 




















Inner-shared 





Outer-shared 














Attributes AXI transaction 

Memory type Shareability | Load | Store | Load exclusive Store exclusive 

Normal, inner Non-cacheable, outer Write- Non-shared Read | Write | Read Write 

Back or Write-Th h, or N li 

a oi pa Aa iahe a orl Inner-shared Read with Write with AWLOCKM 
: pea ARLOCKM set HIGH | set HIGH 

Through or Non-cacheable, or Normal inner Outer-shared oC set HIGH [sẹ 

Write-Back outer Non-cacheable or Write- 

Through 

Normal, inner Write-Back, outer Write-Back Non-shared Read | Write | Read Write when the line is 


evicted 





Related information 
ARM® AMBA® AXI and ACE Protocol Specification AXI3, AXI4, and AXI4-Lite, ACE and ACE-Lite. 
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A8 AXI Master Interface 
A8.4 Attributes of the AXI master interface 


























A8.4 Attributes of the AXI master interface 
The table lists the possible values for the read and write issuing capabilities if the processor includes four 
cores. 
n Number of cores. 
m 1 if the processor is configured for the ACP interface, 0 if it is not. 
Table A8-3 AXI master interface attributes 
Attribute Value | Comments 
Write issuing 16 The cluster can issue a maximum of 16 writes: 
capability e Up to 16 writes to Normal memory that is both inner and outer write-back cacheable. 
e Up to 15 writes to all other memory types, including Device, Normal non-cacheable, and Write- 
through. 
Any mix of memory types is possible, and each write can be a single write or a write burst. 
Read issuing 8n + 4m | 8 for each core in the cluster including up to: 
capability e 8 data linefills. 
e 4non-cacheable or Device data reads. 
e 1 non-cacheable TLB page-walk read. 
e 3 instruction linefills. 
If an ACP is configured, up to 4 ACP linefill requests can be generated. 
Exclusive thread | n Each core can have 1 exclusive access sequence in progress. 
capability 
Write ID 16 The maximum number of outstanding write IDs is 16. This is the same as the maximum number of 
capability outstanding writes. 
Only Device memory types with nGnRnE or nGnRE can have more than one outstanding transaction with 
the same AXI ID. All other memory types use a unique AXI ID for every outstanding transaction. 
Write ID width |5 The ID encodes the source of the memory transaction. See Table A9-7 Encoding for AWIDM/[4:0] 
on page A9-117. 
Read ID 8n + 4m | 8 for each core in the processor and 4 for the ACP. 
capability Only Device memory types with nGnRnE or nGnRE can have more than one outstanding transaction with 
the same AXI ID. All other memory types use a unique AXI ID for every outstanding transaction. 
Read ID width |6 The ID encodes the source of the memory transaction. See Zable A9-8 Encoding for ARIDM[5:0] 











on page A9-117. 








In the following table, nn is the core number @b@@, @b@1, @b10, or @b11. 


Table A8-4 Encoding for AWIDM[4:0] 











Attribute | Value Issuing capability per ID | Comments 
Write ID | @bee@nn | 1 Core nn system domain store exclusive 
@b001xx | 0 Unused 
@b010xx | 0 Unused 
@bO11nn | 15 Core nn non-re-orderable device write 
@b1xxxx | 1 Write to normal memory, or re-orderable device memory 
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A8 AXI Master Interface 
A8.4 Attributes of the AXI master interface 


In the following table, nn is the core number @b@@, @b01, @b10, or @b11. 


Table A8-5 Encoding for ARIDM[5:0] 






































Attribute | Value Issuing capability per ID | Comments 
Read ID | @b@@Onn | 4 Core nn system domain exclusive read or non-reorderable device read 
0b0001xx | 0 Unused 
0b001xxx | 0 Unused 
Qb01xx@0 | 1 ACP read 
0b01xxð1 | 0 Unused 
0b01xx1x | 0 Unused 
@b1xxxnn | 1 Core nn read 











These ID and transaction details are provided for information only. ARM strongly recommends that all 
interconnects and peripherals are designed to support any type and number of transactions on any ID, to 
ensure compatibility with future products. 


Related information 
ARM® AMBA® AXI and ACE Protocol Specification AX13, AXI4, and AXI4-Lite, ACE and ACE-Lite. 
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48.4 Attributes of the AXI master interface 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights reserved. A8-108 
Non-Confidential 


Chapter A9 
ACE Master Interface 


This chapter describes the ACE master interface. 


It contains the following sections: 

e A9.1 About the ACE master interface on page A9-110. 

e A9.2 ACE configurations on page A9-111. 

e A9.3 ACE privilege information on page A9-112. 

e A9.4 ACE transactions on page A9-113. 

e A9.5 Attributes of the ACE master interface on page A9-116. 
e A9.6 Snoop channel properties on page A9-118. 

e A9.7 AXI compatibility mode on page A9-119. 
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A9.1 About the ACE master interface 


A9.1 About the ACE master interface 


You can configure the processor to use the ACE protocol for the master memory interface. 


Read responses 


The ACE master can delay accepting a read data channel transfer by holding RREADY LOW for an 
indeterminate number of cycles. RREADY can be deasserted LOW between read data channel transfers 
that form part of the same transaction. 


The ACE master asserts the read acknowledge signal RACK HIGH in the ACLK cycle following 
acceptance of the last read data channel transfer for a transaction. RACK is asserted in AXI 
compatibility mode in addition to ACE configurations. 

e For interoperability of system components, ARM recommends that components interfacing with the 
ACE master are fully ACE compliant with no reliance on the subset of permitted RACK behavior 
described for the processor. 

e Ifthe interconnect does not perform hazarding between coherent and non-coherent requests, then, 
after it has returned the first transfer of read data for a non-coherent read, it must return all the 
remaining read transfers in the transaction, without requiring progress of any snoops to the cluster 
that could be to the same address. 


Write responses 


The ACE master requires that the slave does not return a write response until it has received the write 
address. 


The ACE master always accepts write responses without delay by holding BREADY HIGH. It asserts 
the write acknowledge signal WACK HIGH in the ACLK cycle following acceptance of a write 
response. WACK is asserted in AXI compatibility mode in addition to ACE configurations. 


For interoperability of system components, ARM recommends that components interfacing with the 
ACE master are fully ACE compliant with no reliance on the subset of permitted BREADY and WACK 
behavior described for the processor. 


Barriers 


The processor does not send barrier transactions to the interconnect. All barriers are terminated within 
the cluster. 


You must ensure that your interconnect and any peripherals connected to it do not return a write response 
for a transaction until that transaction would be considered complete by a later barrier. This means that 
the write must be observable to all other masters in the system. ARM expects the majority of peripherals 
to meet this requirement. 


Related information 
A8.2 AXI privilege information on page A8-103. 
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A9.2 ACE configurations 
A9.2 ACE configurations 
This section describes the ACE configurations. 
Note 
If you want to connect the processor to an AXI interconnect, ARM recommends that you use the AXI 
processor configuration option. Using the ACE processor configuration option in AXI mode is less area- 
efficient than the AXI configuration option. 
Table A9-1 Supported ACE configurations 
Signal Feature 
AXI mode | ACE non-coherent ACE outer coherent ACE inner coherent 
No L3 With L3 No L3 With L3 No L3 With L3 
cache cache cache cache cache cache 
BROADCASTCACHEMAINT |0 0 1 0 1 0 1 
BROADCASTOUTER 0 0 0 1 1 1 1 
BROADCASTINNER 0 0 0 0 0 1 1 
The following table shows the key features in each of the supported ACE configurations. 
Table A9-2 Supported features in the ACE configurations 
Features Configuration 
AXI mode | ACE non- ACE non- ACE outer ACE inner 
coherent, no L3 coherent, with L3 | coherent coherent 
cache cache 
AXI3 or AXI4 compliance Yes No No No No 
ACE compliance No Yes Yes Yes Yes 
Barriers on AR and AW channels | No No No No No 
Cache maintenance requests on No No Yes Yes Yes 
AR channel 
Snoops on AC channel No No No Yes Yes 
Coherent requests on AR or AW | No No No Yes Yes 
channel 
DVM requests on AR channel No No No No Yes 
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ACE privilege information 


A9 ACE Master Interface 
A9.3 ACE privilege information 


ACE provides information about the privilege level of an access on the ARPROTM[0] and 
AWPROTM)[0] signals. However, when accesses might be cached or merged together, the resulting 
transaction can have both privileged and unprivileged data combined. If this happens, the processor 
marks the transaction as privileged, even if it was initiated by an unprivileged process. 


The following table shows exception levels and corresponding ARPROTM[0] and AWPROTM)[0] 


values. 


Table A9-3 ARPROT and AWPROT values 





Processor exception level 


Type of access 


Value of ARPROT[0] and 
AWPROT(0] 





ELO, EL1, EL2, EL3 


Cacheable read access 


Privileged access 





ELO 





ELI, EL2, EL3 


Device, or normal Non-cacheable read access 


Unprivileged access 





Privileged access 





ELO, EL1, EL2, EL3 


Cacheable write access 


Privileged access 




















ELO Device, nGnRnE, nGnRE, and nGRE write Unprivileged access 
EL1, EL2, EL3 Privileged access 
ELO Normal Non-cacheable or Device GRE write, except for STREX, Privileged access 
STREXB, STREXH, STREXD, STXR, STXRB, STXRH, STXP, STLXR, 
STLXRB, STLXRH, and STLXP to shareable memory 
ELO Normal Non-cacheable write for STREX, STREXB, STREXH, Unprivileged access 
STREXD, STXR STXRB, STXRH, STXP, STLXR, STLXRB, STLXRH, 
and STLXP to shareable memory 
EL1, EL2, EL3 Normal Non-cacheable write Privileged access 





ELO, EL1, EL2, EL3 








TLB pagewalk 





Privileged access 
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A9.4 ACE transactions 





















































A9.4 ACE transactions 
The processor generates only a subset of all possible ACE transactions on the ACE master interface. 
The processor does not generate any FIXED bursts and all WRAP bursts fetch a complete cache line 
starting with the critical word first. A burst does not cross a cache line boundary. 
The cache linefill fetch length is always 64 bytes. 
For WriteBack transfers the supported transfers are: 
e WRAP 4 128-bit for read transfers (linefills). 
e INCR 4 128-bit for write transfers (evictions). 
e INCRN (N:1, 2, or 4) 128-bit write transfers (read allocate). 
For Non-cacheable transactions: 
e WRAP 4 128-bit for read transfers. 
e INCRN (N:1, 2, or 4) 128-bit for write transfers. 
e INCRN (N:1, 2, or 4) 128-bit for read transfers. 
e INCR I 32-bit, 64-bit, and 128-bit for read transfers. 
e INCR I 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit for write transfers. 
e INCR I 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit for exclusive write transfers. 
e INCR I 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit for exclusive read transfers. 
For Device transactions: 
e INCRN (N:1, 2, or 4) 128-bit read transfers. 
e INCRN (N:1, 2, or 4) 128-bit write transfers. 
e INCR I 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit read transfers. 
e INCR I 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit write transfers. 
e INCR I 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit exclusive read transfers. 
e INCR I 8-bit, 16-bit, 32-bit, 64-bit, and 128-bit exclusive write transfers. 
External memory accesses generate the following transactions in an implementation configured with an 
ACE master interface. 
Table A9-4 ACE transactions 
Attributes ACE transaction 
Memory type Shareability | Domain | Load Store Load exclusive | Store exclusive 
Device - System ReadNoSnoop | WriteNoSnoop ReadNoSnoop and | WriteNoSnoop and 
ARLOCKM set to | AWLOCKM set to 
HIGH HIGH 
Normal, inner Non- Non-shared | System ReadNoSnoop | WriteNoSnoop ReadNoSnoop and | WriteNoSnoop and 
cacheable, outer Non- I hared ARLOCKM set to | AWLOCKM set to 
cacheable meer HIGH HIGH 
Outer-shared 
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A9.4 ACE transactions 


Table A9-4 ACE transactions (continued) 























Attributes ACE transaction 
Memory type Shareability | Domain | Load Store Load exclusive | Store exclusive 
Normal, inner Non- Non-shared | System ReadNoSnoop | WriteNoSnoop ReadNoSnoop ReadNoSnoop 
heable, outer Write- ; ; : ; 
T . ee on Inner-shared | System ReadNoSnoop | WriteNoSnoop ReadNoSnoop with | WriteNoSnoop with 
ARLOCKM set to | ARLOCKM set t 
Through, or Normal, Outer-shared | System 9E REIR of ie 
: é HIGH HIGH 
inner Write-Through, 
outer Write-Back, 
Write-Through or Non- 
cacheable, or Normal 
inner Write-Back outer 
Non-cacheable or 
Write-Through 
Normal, inner Write- Non-shared | Non- ReadNoSnoop | WriteNoSnoop ReadNoSnoop WriteNoSnoop 
Back, outer Write-Back shareable 
Inner-shared | Inner ReadShared | ReadUnique or ReadShared with CleanUnique with 
Shareable CleanUnique if ARLOCKM set to | ARLOCKM set to 
required, then a HIGH HIGH if required, 
Quire hated: | Outer WriteBack when then a WriteBack 
Shareable ee ae 
the line is evicted when the line is 
evicted 
































The following table shows the ACE transactions that can be generated, and some typical operations that 
might cause the transactions to be generated. This is not an exhaustive list of ways to generate each type 
of transaction, because there are many possibilities. 


Table A9-5 ACE transactions and typical operations 















































Transaction Operation 

ReadNoSnoop Non-cacheable loads or instruction fetches. Linefills of non-shareable cache lines into L1 or L2. 

ReadOnce Cacheable loads that are not allocating into the cache, or cacheable instruction fetches when there is no L2 
cache. 

ReadClean Not used. 

ReadNotSharedDirty | Not used. 

ReadShared L1 Data linefills started by a load instruction, or L2 linefills started by an instruction fetch. 

ReadUnique L1 Data linefills started by a store instruction. 

CleanUnique Store instructions that hit in the cache but the line is not in a unique coherence state. Store instructions that are 
not allocating into the L1 or L2 caches, for example when streaming writes. 

MakeUnique Store instructions of a full cache line of data, that miss in the caches, and are allocating into the L2 cache. 

CleanShared Cache maintenance instructions. 

CleanInvalid Cache maintenance instructions. 

MakelInvalid Cache maintenance instructions. 

DVM TLB and instruction cache maintenance instructions. 

DVM complete DVM sync snoops received from the interconnect. 
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A9.4 ACE transactions 


Table A9-5 ACE transactions and typical operations (continued) 














Transaction Operation 

Barriers DMB and DSB instructions. DVM sync snoops received from the interconnect. 
WriteNoSnoop Non-cacheable store instructions. Evictions of non-shareable cache lines from L1 and L2. 
WriteUnique Not used. 





WriteLineUnique Not used. 





WriteBack Evictions of dirty lines from the L1 or L2 cache, or streaming writes that are not allocating into the cache. 





WriteClean Evictions of dirty lines from the L2 cache, when the line is still present in an L1 cache. Some cache 
maintenance instructions. 





WriteEvict Evictions of unique clean lines, when configured in the LZACTLR. 














Evict Evictions of clean lines, when configured in the L2ACTLR. 





Related information 
ARM® AMBA® AXI and ACE Protocol Specification AXI3, AXI4, and AXT4-Lite, ACE and ACE-Lite. 
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A9.5 Attributes of the ACE master interface 


























A9.5 Attributes of the ACE master interface 
The table lists the maximum possible values for the read and write issuing capabilities if the processor 
includes four cores. 
n Number of cores. 
m 1 if the processor is configured for the ACP interface, 0 if it is not. 
Table A9-6 ACE master interface attributes 
Attribute Value | Comments 
Write issuing 16 The cluster can issue a maximum of 16 writes: 
capability e Up to 16 writes to Normal memory that is both inner and outer write-back cacheable. 
e Upto 15 writes to all other memory types, including Device, Normal non-cacheable, and Write- 
through. 
Any mix of memory types is possible, and each write can be a single write or a write burst. 
Read issuing 8n + 4m | 8 for each core in the cluster including up to: 
capability e 8 data linefills. 
e 4non-cacheable or Device data reads. 
e 1 non-cacheable TLB page-walk read. 
e 3 instruction linefills. 
e 5 coherency operations. 
* 8 DVM messages. 
The 8 DVM messages per core can each be two-part DVM messages. They result in up to 16 DVM 
transactions per core. 
If an ACP is configured, up to 4 ACP linefill requests can be generated. 
Exclusive thread | n Each core can have 1 exclusive access sequence in progress. 
capability 
Write ID 16 The maximum number of outstanding write IDs is 16. This is the same as the maximum number of 
capability outstanding writes. 
Only Device memory types with nGnRnE or nGnRE can have more than one outstanding transaction with 
the same AXI ID. All other memory types use a unique AXI ID for every outstanding transaction. 
Write ID width |5 The ID encodes the source of the memory transaction. See Table A9-7 Encoding for AWIDM{4:0] 
on page A9-117. 
Read ID 8n + 4m | 8 for each core in the processor and 4 for the ACP. 
capability Only Device memory types with nGnRnE or nGnRE can have more than one outstanding transaction with 
the same AXI ID. All other memory types use a unique AXI ID for every outstanding transaction. 
Two part DVMs use the same ID for both parts, and therefore can have two outstanding transactions on 
the same ID. 
Read ID width |6 The ID encodes the source of the memory transaction. See Zable A9-8 Encoding for ARIDM[5:0] 











on page A9-117. 








In the following table, nn is the core number @b@@, @b01, @b10, or @b11. 
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A9.5 Attributes of the ACE master interface 


Table A9-7 Encoding for AWIDM[4:0] 





























Attribute | Value Issuing capability per ID | Comments 
Write ID | @bee@nn | 1 Core nn system domain store exclusive 
@b801xx | 0 Unused 
@b010xx | 0 Unused 
@b@11nn | 15 Core nn non-re-orderable device write 
@b1xxxx | 1 Write to normal memory, or re-orderable device memory 











In the following table, nn is the core number @b@@, @b01, @b10, or @b11. 


Table A9-8 Encoding for ARIDM[5:0] 















































Attribute | Value Issuing capability per ID | Comments 

Read ID | @b@@@Onn | 4 Core nn exclusive read or non-reorderable device read 
0b0001xx | 0 Unused 
0b001880 | 0 Unused 
0b001001 | 1 DVM complete 
0b00101x | 0 Unused 
0b0011xx | 0 Unused 
0b01xxðð | 1 ACP read 
@b@1xx@1 | 0 Unused 
@b@1xx1x | 0 Unused 
@b1xxxnn | 1 Core nn read 











These ID and transaction details are provided for information only. ARM strongly recommends that all 
interconnects and peripherals are designed to support any type and number of transactions on any ID, to 
ensure compatibility with future products. 


Related information 
ARM® AMBA® AXI and ACE Protocol Specification AXI3, AXI4, and AXT4-Lite, ACE and ACE-Lite. 
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A9.6 Snoop channel properties 


The table shows the properties of the ACE channels. 


Table A9-9 ACE channel properties 











Property Value Comment 

Snoop 8 The SCU can accept and process a maximum of eight snoop requests from the system. It counts 
acceptance requests from the request being accepted on the AC channel to the response being accepted on the CR 
capability channel. 

Snoop latency Hit When there is a hit in L2 cache, the best case for response and data is 13 processor cycles. When there 


is a miss in L2 cache and a hit in L1 cache, the best case for response and data is 16 processor cycles. 


Latencies can be higher if hazards occur or if there are not enough buffers to absorb requests. 











Miss Best case six processor cycles when the SCU duplicate tags and L2 tags indicate the miss. 
DVM The cluster takes a minimum of six cycles to provide a response to DVM packets. 
Snoop filter Supported | The cluster provides support for an external snoop filter in an interconnect. It indicates when clean lines 


are evicted from the processor by sending Evict transactions on the write channel. 


However there are some cases where incorrect software can prevent an Evict transaction from being 
sent. Therefore you must ensure that you build any external snoop filter to handle a capacity overflow 
that sends a back-invalidation to the processor if it runs out of storage. 


Examples of cases where evicts are not produced include: 
e  Linefills that take external aborts. 

e Store exclusives that fail. 

e Mismatched aliases. 





Supported - All transactions described by the ACE protocols: 
transactions e Are accepted on the master interface from the system. 
* Can be produced on the ACE master interface except: 

— WriteUnique. 

— WriteLineUnique. 

— ReadNotSharedDirty. 

— ReadClean. 

















Related information 
ARM® AMBA® AXI and ACE Protocol Specification AX13, AXI4, and AXI4-Lite, ACE and ACE-Lite. 
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A9.7 AXI compatibility mode 


The processor implements an AXI3/AXI4 compatibility mode in ACE configurations. With this mode 
you can use the processor in a standalone environment where the AMBA 4 ACE interface is not 
required. 


To enable the AXI compatibility mode, you must ensure that the BROADCASTINNER, 
BROADCASTOUTER, and BROADCASTCACHEMAINT input pins are set to LOW. 
Note 


The AXI build-time configuration option provides a more area-efficient AXI solution than the AXI 
compatibility mode in ACE configurations. 
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49.7 AXI compatibility mode 
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Chapter A10 
CHI Master Interface 


This chapter describes the CHI master memory interface. 


It contains the following sections: 

e A10.1 About the CHI master interface on page A10-122. 

e A10.2 CHI configurations on page A10-123. 

e A10.3 Attributes of the CHI master interface on page A10-124. 
e A10.4 CHI channel properties on page A10-126. 

e Al0.5 CHI transactions on page A10-127. 
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A10.1 About the CHI master interface 


You can configure the processor to use the CHI protocol for the master memory interface. 
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A10.2 CHI configurations 







































































A10.2 CHI configurations 
This section describes the CHI configurations. 
The following table shows the permitted combinations of these signals and the supported configurations 
in the Cortex-A35 processor, with a CHI bus. 
Table A10-1 Supported CHI configurations 
Signal Feature 
CHI non-coherent CHI outer coherent CHI inner coherent 
No L3 cache | With L3 No L3 cache | With L3 No L3 cache | With L3 
cache cache cache 
BROADCASTCACHEMAINT | 0 1 0 1 0 1 
BROADCASTOUTER 0 0 1 1 1 1 
BROADCASTINNER 0 0 0 0 1 1 
The following table shows the key features in each of the supported CHI configurations. 
Table A10-2 Supported features in the CHI configurations 
Features Configuration 
CHI non-coherent, CHI non-coherent, CHI outer CHI inner 
no L3 cache with L3 cache coherent coherent 
Cache maintenance requests on No Yes Yes Yes 
TXREQ channel 
Snoops on RXREQ channel No No Yes Yes 
Coherent requests on TXREQ No No Yes Yes 
channel 
DVM requests on TXREQ channel | No No No Yes 
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A10.3 Attributes of the CHI master interface 

















A10.3 Attributes of the CHI master interface 
The table lists the possible values for the read and write issuing capabilities if the processor includes four 
cores. 
n Number of cores. 
m 1 if the processor is configured for the ACP interface, 0 if it is not. 
w (write issuing capability)+1. 
Table A10-3 Attributes of the CHI master memory interface 
Attribute Value Comments 
Write issuing Configuration The maximum number of writes varies, depending on the configuration of the processor: 
capability dependent ° The number of cores. 
¢ The presence of the L2 cache. 
If no L2 cache is configured: 
One 5 outstanding writes. 
core 
2-4 8 outstanding writes. 
cores 
If an L2 cache is configured: 
One 7 outstanding writes. 
core 
2-4 10 outstanding write. 
cores 
A cluster with four cores, with L2 cache, can issue 10 outstanding transactions. A processor 
with one core, without L2 cache, can issue five outstanding transactions. 
All outstanding transactions use a unique ID. 
Read issuing 8n+4m+ 1 8 for each core in the cluster including up to: 
capability e 8 data linefills. 
e 4Non-cacheable or Device data reads. 
e 1 Non-cacheable TLB page-walk read. 
e 3 instruction linefills. 
e 5 coherency operations. 
e | barrier operation. 
* 8 DVM messages. 
If an ACP is configured, up to 4 ACP linefill requests can be generated. 1 barrier operation 
is generated from the cluster. 
Exclusive thread |n Each core can have 1 exclusive access sequence in progress. 
capability 
Transaction ID 8 The ID encodes the source of the memory transaction. See 49.5 Attributes of the ACE 


width 


master interface on page A9-116. 





Transaction ID 
capability 








8n+4m+wt l 





8 for each core in the cluster in addition to: 


Unlike in configurations with AXI or ACE, there is never any ID reuse in CHI 
implementations, regardless of the memory type. 


4 for the ACP interface. 
1 for barriers. 
6 to 11 writes, depending on the write issuing capability. 
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A10.3 Attributes of the CHI master interface 


There is no fixed mapping between CHI transaction IDs and cores. Some transaction IDs can be used for 
either reads or writes. 


Related information 
A9.5 Attributes of the ACE master interface on page A9-116. 
ARM® AMBA® 5 CHI Protocol Specification. 
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A10.4 CHI channel properties 


You can configure the processor to use the CHI protocol for the master memory interface 


Table A10-4 CHI channel properties 























Property Value Comment 
Snoop acceptance | 10 The SCU can accept and process a maximum of 10 snoop requests from the system. 
capability 
DVM acceptance | 4 The SCU can accept and process a maximum of four DVM transactions from the system. Each of 
capability these four transactions can be a two part DVM message. 
The interconnect must be configured to never send more than four DVM messages to a Cortex-A35 
processor, otherwise the system might deadlock. 
Snoop latency Hit When there is a hit in L2 cache, the best case for response and data is 11 processor cycles. When there 
is a miss in L2 cache and a hit in L1 cache, the best case for response and data is 14 processor cycles. 
Latencies can be higher if hazards occur or if there are not enough buffers to absorb requests. 
Miss Best case six processor cycles when the SCU duplicate tags and L2 tags indicate the miss. 
DVM The cluster takes a minimum of six cycles to provide a response to DVM packets. 
Snoop filter Supported | The cluster provides support for an external snoop filter in an interconnect. It indicates when clean 


lines are evicted from the processor by sending Evict transactions on the CHI write channel. However, 
there are some cases where incorrect software can prevent an Evict transaction from being sent, 
therefore you must ensure that any external snoop filter is built to handle a capacity overflow that 
sends a back-invalidation to the processor if it runs out of storage. 





Supported 
transactions 











All transactions described by the CHI protocol: 
e Are accepted on the CHI master interface from the system. 
* Can be produced on the CHI master interface except: 

— ReadClean. 

— WriteBackPtl. 

— WriteCleanPtl. 








Related information 
ARM® AMBA® 5 CHI Protocol Specification. 
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A10.5 CHI transactions 


CHI transactions are sent to a specific node in the interconnect based on the following criteria: 


e Type of access. 
e Address of the access. 
e Settings of the System Address Map. 


Addresses that map to an HN-F node can be marked as cacheable memory in the page tables, and can 
take part in the cache coherency protocol. Addresses that map to an HN-I or MN must be marked as 
device or non-cacheable memory. 


Table A10-5 CHI transaction IDs 





Transaction ID | Description 





000nnxxx Transaction from core nn. Can be a: 
e Read transaction. 

¢ Write transaction. 

e Cache maintenance transaction. 
e DVM transaction. 

¢ Barrier transaction. 











001001xx Transaction from the ACP interface. Can be a read or write. 
00101110 Barrier generated in response to a DVM sync snoop from the interconnect. 
0100xxxx Eviction from L1 or L2 cache. The number of IDs used depends on the configuration. 














Table A10-6 CHI transactions 







































































Transaction Operation 
ReadNoSnp Non-cacheable loads or instruction fetches. Linefills of non-shareable cache lines into L1 or L2. 
ReadOnce Cacheable loads that are not allocating into the cache, or cacheable instruction fetches when there is no L2 cache. 
ReadClean Not used. 
ReadShared L1 Data linefills started by a load instruction, or L2 linefills started by an instruction fetch. 
ReadUnique L1 Data linefills started by a store instruction. 
CleanUnique Store instructions that hit in the cache but the line is not in a unique coherence state. 
MakeUnique Store instructions of a full cache line of data, that miss in the caches, and are allocating into the L2 cache. 
CleanShared Cache maintenance instructions. 
CleanInvalid Cache maintenance instructions. 
MakelInvalid Cache maintenance instructions. 
DVMOp TLB and instruction cache maintenance instructions. 
EOBarrier DMB instructions. 
ECBarrier DSB instructions. DVM sync snoops received from the interconnect. 
WriteNoSnpPtl | Non-cacheable store instructions. 
WriteNoSnpFull | Non-cacheable store instructions, or evictions of non-shareable cache lines from the L1 and L2 cache. 
WriteUniqueFull | Cacheable writes of a full cache line, that are not allocating into L1 or L2 caches, for example streaming writes. 
WriteUniquePtl | Cacheable writes of less than a full cache line that are not allocating into L1 or L2. 
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A10.5 CHI transactions 


Table A10-6 CHI transactions (continued) 




























































































Transaction Operation 
WriteBackFull | Evictions of dirty lines from the L1 or L2 cache. 
WriteBackPtl Not used. 
WriteCleanFull | Evictions of dirty lines from the L2 cache, when the line is still present in an L1 cache. Some cache maintenance 
instructions. 
WriteCleanPtl Not used. 
WriteEvictFull | Evictions of unique clean lines, when configured in the LAACTLR. 
Evict Evictions of clean lines, when configured in the LAACTLR. 
External memory accesses generate the following transactions in an implementation configured with a 
CHI master interface. 
Table A10-7 CHI transactions 
Attributes CHI transaction 
Memory type Shareability | SnpAttr Load Store Load Store exclusive 
exclusive 
Device - Non- ReadNoSnp | WriteNoSnp ReadNoSnp and | WriteNoSnp and 
snoopable Excl set to Excl set to HIGH 
HIGH 
Normal, inner Non- Non-shared | Non- ReadNoSnp | WriteNoSnp ReadNoSnp and | WriteNoSnp and 
cacheable, outer Non- I hared snoopable Excl set to Excl set to HIGH 
nner-shar 
cacheable AR HIGH 
Outer-shared 
Normal, inner Non- Non-shared | Non- ReadNoSnp | WriteNoSnp ReadNoSnp ReadNoSnp 
cacheable, outer Write- snoopable 
Back or Write- ; ; : ; 
Through. or N l Inner-shared | Non- ReadNoSnp | WriteNoSnp ReadNoSnp with | WriteNoSnp with 
ough, or Normal, 
; : : snoopable Excl set to Excl set to HIGH 
inner Write-Through, HIGH 
outer Write-Back, Outer-shared | Non- 
Write-Through or Non- snoopable 
cacheable, or Normal 
inner Write-Back outer 
Non-cacheable or 
Write-Through 
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A10.5 CHI transactions 


Table A10-7 CHI transactions (continued) 















































Attributes CHI transaction 
Memory type Shareability | SnpAttr Load Store Load Store exclusive 
exclusive 
Normal, inner Write- Non-shared | Non- ReadNoSnp | WriteNoSnp ReadNoSnp WriteNoSnp 
Back, outer Write-Back snoopable 
Inner-shared | Inner ReadShared | ReadUnique, ReadShared with | CleanUnique with 
snoopable CleanUnique, or Excl set to Excl set to HIGH if 
MakeUni if HIGH i th 
Outer-shared | Outer : elite i G required, o 
noonabi allocating into the WriteBackFull when 
tae cache, then a the line is evicted 
WriteBackFull when 
the line is evicted. 
WriteUniqueFull or 
WriteUniquePtl if not 
allocating into the 
cache. 
Related information 
ARM® AMBA® 5 CHI Protocol Specification. 
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Chapter A11 
ACP Slave Interface 


This chapter describes the ACP slave interface. 


It contains the following sections: 

e All.1 About the ACP on page A11-132. 

e All.2 Transfer size support on page A11-133. 
e All.3 ACP performance on page A11-134. 

e All.4 ACP user signals on page A11-135. 
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A11.1 About the ACP 


A11.1 About the ACP 


The optional Accelerator Coherency Port (ACP) is implemented as an AXI4 slave interface with some 
restrictions. 


128-bit read and write interfaces. 

ARCACHE and AWCACHE are restricted to Normal, Write-Back, Read-Write-Allocate, Read- 
Allocate, Write-Allocate, and No-Allocate memory. ARCACHE and AWCACHE are limited to the 
values @b@111, @b1011, and @b1111. Other values cause a SLVERR response on RRESP or BRESP. 
Exclusive accesses are not supported. 

Barriers are not supported. The BRESP handshake for a write transaction indicates global 
observability for that write. 

ARSIZE and AWSIZE signals are not present and assume a value of @b1@, 16 bytes. 

ARBURST and AWBURST signals are not present and assume a value of INCR. 

ARLOCK and AWLOCK signals are not present. 

ARQOS and AWQOS signals are not present. 

ARLEN and AWLEN are limited to values 0 and 3. 
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A11 ACP Slave Interface 
A11.2 Transfer size support 


A11.2 Transfer size support 
ACP supports the following read-request transfer size and length combinations: 


e 64 byte INCR request characterized by: 
— ARLEN is 0x03, 4 beats. 
— ARADDR aligned to 64 byte boundary, so ARADDRJ5:0] is 0b00 0000. 
— ARSIZE and ARBURST assume values of @b10@ and INCR respectively. 
* 16 byte INCR request characterized by: 
— ARLEN is 0x80, | beat. 
— ARADDR aligned to 16 byte boundary, so ARADDR[3:0] is exe. 


ACP supports the following write-request transfer size and length combinations: 
* 64 byte INCR request characterized by: 
— AWLEN is 0x03, 4 beats. 
— AWADDR aligned to 64 byte boundary, so AWADDRJ5:0] is @bee 0000. 
— AWSIZE and AWBURST assume values of @b10@ and INCR respectively. 
— WSTRB for all beats must be the same and either all asserted or all deasserted. 
e 16 byte INCR request characterized by: 
— AWLEN is 0x09, | beat. 
— AWADDR aligned to 16 byte boundary, so AWADDR{3:0] is 0x®. 
— AWSIZE and AWBURST assume values of @b10@ and INCR respectively. 
— WSTRB can take any value. 


Requests not meeting these restrictions cause a SLVERR response on RRESP or BRESP. 
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A11 ACP Slave Interface 
A11.3 ACP performance 


A11.3 ACP performance 


The ACP interface can support up to four outstanding transactions. These can be any combination of 
reads and writes. 


The master must avoid sending more than one outstanding transaction on the same AXI ID, to prevent 
the second transaction stalling the interface until the first has completed. If the master requires explicit 
ordering between two transactions, ARM recommends that it waits for the response to the first 
transaction before sending the second transaction. 


Writes are higher performance when they contain a full cache line of data. 


If SCU cache protection is configured, writes of less than 64 bits incur an overhead of performing a read- 
modify-write sequence if they hit in the L2 cache. 


Some L2 resources are shared between the ACP interface and the cores, therefore heavy traffic on the 
ACP interface might, in some cases, reduce the performance of the cores. 


AXI and You can use the ARCACHE and AWCACHE signals to control whether the ACP request 





ACE causes an allocation into the L2 cache if it misses. 
CHI To ensure correct ordering of data beats, ACP reads that miss always allocate into the L2 
cache. 
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A11.4 ACP user signals 


ACP transactions can cause coherent requests to the system. Therefore ACP requests must pass Inner and 
Outer Shareable attributes to the L2. Use specific encoding to pass the shareability attribute. 


A11 ACP Slave Interface 
A11.4 ACP user signals 


Table A11-1 Encoding of the ACP shareability attribute 





AxUSER[1:0] 


Attribute 














ebee Non-shareable 
@be1 Inner Shareable 
@b10 Outer Shareable 











This is the same encoding as AXDOMAIN on ACE, except that a value of @b11 is not supported. 
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All ACP Slave Interface 
All.4 ACP user signals 
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Chapter A12 
GIC CPU Interface 


This chapter describes the Generic Interrupt Controller (GIC) CPU interface of the processor. 


It contains the following sections: 


e A12.1 Bypassing the GIC CPU Interface on page A12-138. 
+ A1l2.2 Memory map for the GIC CPU interface on page A12-139. 
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A12 GIC CPU Interface 
A12.1 Bypassing the GIC CPU Interface 


A12.1 Bypassing the GIC CPU Interface 


The processor optionally implements the GIC CPU Interface. If present, you can disable it by asserting 
the GICCDISABLE signal HIGH at reset. 


If the GIC is enabled, the input pins nVIRQ and nVFIQ must be tied off to HIGH because the internal 
GIC CPU interface generates the virtual interrupt signals to the cores. Software controls the nIRQ and 
nFIQ signals, therefore there is no requirement to tie them HIGH. If you disable the GIC CPU interface, 
a GIC that is external to the processor can drive the input signals nVIRQ and nVFIQ. 


Asserting the GICCDISABLE signal HIGH at reset removes access to the memory-mapped and system 
GIC CPU Interface registers. 


Related information 
B2.54 AArch64 Processor Feature Register 0, ELI on page B2-437. 
B1.85 Processor Feature Register 1 on page B1-280. 
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A12.2 Memory map for the GIC CPU interface 


A12 GIC CPU Interface 
A12.2 Memory map for the GIC CPU interface 


The GIC CPU Interface is a memory-mapped interface. It is offset from PERIPHBASE. 


If GICCDISABLE is asserted, the registers are not available. 


Table A12-1 GIC memory map 





Address range 


Functional block 





0x00000-0x01FFF 


CPU Interface 





0x02000-OxOF FFF 


Reserved 





0x10000-0x10F FF 


Virtual Interface Control 





0x11000-Ox1FFFF 


Reserved 





0x20000-0x21FFF 


Virtual CPU Interface 





0x22000-0x2EFFF 


Reserved 





0x2F000-0x30FFF 


Alias of Virtual CPU Interface 





0x31000-0x3FFFF 








Reserved 








Related information 
B2.54 AArch64 Processor Feature Register 0, ELI on page B2-437. 
B1.85 Processor Feature Register 1 on page B1-280. 
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A12 GIC CPU Interface 
412.2 Memory map for the GIC CPU interface 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights reserved. A12-140 
Non-Confidential 


Part B 


Register Descriptions 


Chapter B1 
AArch32 system registers 


This chapter describes the system registers in the AArch32 state. 


It contains the following sections: 

e B11 AArch32 register summary on page B1-146. 

e B1.2 c0 registers on page B1-148. 

e B1.3 cl registers on page B1-150. 

e B1.4 c2 registers on page B1-151. 

e B1.5 c3 registers on page B1-152. 

e B1.6 c4 registers on page B1-153. 

e B1.7 c5 registers on page B1-154. 

e B18 c6 registers on page B1-155. 

e B1.9 c7 registers on page B1-156. 

e B1.10 c7 system operations on page B1-157. 

e B1.11 c8 system operations on page B1-159. 

e B1.12 c9 registers on page B1-161. 

e B1.13 c10 registers on page B1-162. 

e B1.14 cll registers on page B1-163. 

e B1.15 c12 registers on page B1-164. 

e B1.16 c13 registers on page B1-166. 

e B1.17c14 registers on page B1-167. 

e B118 c15 registers on page B1-168. 

e B1.19 64-bit registers on page B1-169. 

¢ B1.20 AArch32 Identification registers on page B1-170. 
¢ B1.21 AArch32 Virtual memory control registers on page B1-171. 
e B1.22 AArch32 Fault handling registers on page B1-172. 
e B1.23 AArch32 Other System control registers on page B1-173. 
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B1 AArch32 system registers 


e B1.24 AArch32 Address registers on page B1-174. 

¢ B1.25 AArch32 Thread registers on page B1-175. 

e B1.26 AArch32 Performance monitor registers on page B1-176. 

¢ B1.27 AArch32 Secure registers on page B1-177. 

e B1.28 AArch32 Virtualization registers on page B1-178. 

e B1.29 AArch32 GIC system registers on page B1-179. 

¢ B1.30 AArch32 Generic Timer registers on page B1-181. 

e B1.31 AArch32 Implementation defined registers on page B1-182. 

e B1.32 Auxiliary Control Register on page B1-184. 

e B1.33 Auxiliary Data Fault Status Register on page B1-186. 

e B1.34 Auxiliary ID Register on page B1-187. 

¢ B1.35 Auxiliary Instruction Fault Status Register on page B1-188. 

¢ B1.36 Auxiliary Memory Attribute Indirection Register 0 on page B1-189. 

¢ B1.37 Auxiliary Memory Attribute Indirection Register I on page B1-190. 

¢ B1.38 Configuration Base Address Register on page B1-191. 

¢ B1.39 Cache Size ID Register on page B1-192. 

¢ B1.40 Cache Level ID Register on page B1-194. 

¢ B1.41 Architectural Feature Access Control Register on page B1-196. 

e B1.42 CPU Auxiliary Control Register on page B1-198. 

e B1.43 CPU Extended Control Register on page B1-202. 

¢ B1.44 CPU Memory Error Syndrome Register on page B1-204. 

¢ B1.45 Cache Size Selection Register on page B1-207. 

¢ B1.46 Cache Type Register on page B1-209. 

¢ B1.47 Domain Access Control Register on page B1-211. 

¢ B1.48 Data Fault Address Register on page B1-212. 

¢ B1.49 Data Fault Status Register on page B1-213. 

¢ B1.50 DFSR with Short-descriptor translation table format on page B1-214. 
¢ B1.51 DFSR with Long-descriptor translation table format on page B1-216. 
e B1.52 Encoding of ISS[24:20] when HSR[31:30] is 0b00 on page B1-218. 
e B1.53 FCSE Process ID Register on page B1-219. 

e B1.54 Hyp Auxiliary Configuration Register on page B1-220. 

e B1.55 Hyp Auxiliary Control Register on page B1-221. 

¢ B1.56 Hyp Auxiliary Data Fault Status Syndrome Register on page B1-223. 
© B1.57 Hyp Auxiliary Instruction Fault Status Syndrome Register on page B1-224. 
¢ B1.58 Hyp Auxiliary Memory Attribute Indirection Register 0 on page B1-225. 
© B1.59 Hyp Auxiliary Memory Attribute Indirection Register 1 on page B1-226. 
¢ B1.60 Hyp Architectural Feature Trap Register on page B1-227. 

e B1.61 Hyp Configuration Register on page B1-230. 

e B1.62 Hyp Configuration Register 2 on page B1-236. 

e B1.63 Hyp Debug Control Register on page B1-238. 

¢ B1.64 Hyp Data Fault Address Register on page B1-241. 

¢ B1.65 Hyp Instruction Fault Address Register on page B1-242. 

¢ B1.66 Hyp IPA Fault Address Register on page B1-243. 

e BI1.67 Hyp System Control Register on page B1-244. 

e B1.68 Hyp Syndrome Register on page B1-248. 

e B1.69 Hyp System Trap Register on page B1-249. 

¢ B1.70 Hyp Translation Control Register on page B1-252. 

¢ B1.71 Hyp Vector Base Address Register on page B1-254. 

e B1.72 Auxiliary Feature Register 0 on page B1-255. 

e B1.73 Debug Feature Register 0 on page B1-256. 

¢ B1.74 Instruction Set Attribute Register 0 on page B1-258. 

¢ B1.75 Instruction Set Attribute Register 1 on page B1-260. 

¢ B1.76 Instruction Set Attribute Register 2 on page B1-262. 

¢ B1.77 Instruction Set Attribute Register 3 on page B1-264. 

¢ B1.78 Instruction Set Attribute Register 4 on page B1-266. 

¢ B1.79 Instruction Set Attribute Register 5 on page B1-268. 
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¢« B1.80 Memory Model Feature Register 0 on page B1-270. 

¢ B1.81 Memory Model Feature Register I on page B1-272. 

¢ B1.82 Memory Model Feature Register 2 on page B1-274. 

¢ B1.83 Memory Model Feature Register 3 on page B1-276. 

¢ B1.84 Processor Feature Register 0 on page B1-278. 

e B1.85 Processor Feature Register 1 on page B1-280. 

¢ B1.86 Instruction Fault Address Register on page B1-282. 

¢ B1.87 Instruction Fault Status Register on page B1-283. 

¢ B1.88 IFSR with Short-descriptor translation table format on page B1-284. 

¢ B1.89 IFSR with Long-descriptor translation table format on page B1-285. 

e B1.90 Interrupt Status Register on page B1-287. 

e B1.91 L2 Auxiliary Control Register on page B1-289. 

e B1.92 L2 Control Register on page B1-291. 

¢ B1.93 L2 Extended Control Register on page B1-293. 

¢ B1.94 L2 Memory Error Syndrome Register on page B1-295. 

¢ B1.95 Memory Attribute Indirection Registers 0 and I on page B1-298. 

e B1.96 Main ID Register on page B1-301. 

¢ B1.97 Multiprocessor Affinity Register on page B1-303. 

¢ B1.98 Non-Secure Access Control Register on page B1-305. 

¢ B1.99 Normal Memory Remap Register on page B1-307. 

¢ B1.100 Physical Address Register on page B1-309. 

e B1.101 Primary Region Remap Register on page B1-310. 

e B1.102 Revision ID Register on page B1-313. 

e BI1.103 Reset Management Register on page B1-314. 

¢ B1.104 Secure Configuration Register on page B1-316. 

¢ B1.105 System Control Register on page B1-319. 

¢ B1.106 Secure Debug Control Register on page B1-323. 

e B1.107 Secure Debug Enable Register on page B1-325. 

e B1.108 TCM Type Register on page B1-326. 

e B1.109 TLB Type Register on page B1-327. 

¢ B1.110 Translation Table Base Control Register on page B1-328. 

¢ B1.111 TTBCR with Short-descriptor translation table format on page B1-329. 
¢ B1.112 TTBCR with Long-descriptor translation table format on page B1-330. 
¢ B1.113 Translation Table Base Register 0 on page B1-333. 

¢ B1.114 TTBRO with Short-descriptor translation table format on page B1-334. 
¢ B1.115 TTBRO with Long-descriptor translation table format on page B1-336. 
¢ B1.116 Translation Table Base Register 1 on page B1-337. 

¢ B1.117 TTBR] with Short-descriptor translation table format on page B1-338. 
¢ B1.118 TTBRI1 with Long-descriptor translation table format on page B1-340. 
e B1.119 Vector Base Address Register on page B1-341. 

e B1.120 Virtualization Multiprocessor ID Register on page B1-342. 

¢ B1.121 Virtualization Processor ID Register on page B1-343. 

e B1.122 Virtualization Translation Control Register on page B1-344. 
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B1 AArch32 system registers 
B1.1 AArch32 register summary 


B1.1 AArch32 register summary 


In AArch32 state, you access the system registers through a conceptual coprocessor, identified as CP15, 
the System Control Coprocessor. 


Within CP15, there is a top-level grouping of system registers by a primary coprocessor register number, 
c0-c15. See the ARM” Architecture Reference Manual ARMV8, for ARMV8-A architecture profile for 
more information about using the conceptual System Control Coprocessor in a VMSA context. 


The system register space includes System operations system registers and System operations. The 
description of the system register space describes the permitted access, RO, WO, or RW, to each register 
or operation. 


The following sections describe the CP15 system control registers grouped by CRn order, and are 
accessed by the MCR and MRC instructions. 


e B1.2 c0 registers on page B1-148. 

e B1.3 cl registers on page B1-150. 

e B1.4 c2 registers on page B1-151. 

e B1.5 c3 registers on page B1-152. 

e B1.6 c4 registers on page B1-153. 

e B1.7 c5 registers on page B1-154. 

e B18 c6 registers on page B1-155. 

e B1.9 c7 registers on page B1-156. 

e B1.10 c7 system operations on page B1-157. 
e B1.11 c8 system operations on page B1-159. 
e B1.12 c9 registers on page B1-161. 

e B1.13 c10 registers on page B1-162. 

e B1.14 cll registers on page B1-163. 

e B1.15 c12 registers on page B1-164. 

e B1.16 c13 registers on page B1-166. 

e B1.17c14 registers on page B1-167. 

e B1.18 c15 registers on page B1-168. 


The following subsection describes the 64-bit registers and provides cross-references to individual 
register descriptions: 


e B1.19 64-bit registers on page B1-169. 


In addition to listing the CP15 system registers by CRn ordering, the following subsections describe the 
CP15 system registers by functional group: 

e B1.20 AArch32 Identification registers on page B1-170. 

¢ B1.21 AArch32 Virtual memory control registers on page B1-171. 
e B1.22 AArch32 Fault handling registers on page B1-172. 

e B1.23 AArch32 Other System control registers on page B1-173. 

e B1.24 AArch32 Address registers on page B1-174. 

e B1.25 AArch32 Thread registers on page B1-175. 

e B1.26 AArch32 Performance monitor registers on page B1-176. 

e B1.27 AArch32 Secure registers on page B1-177. 

e B1.28 AArch32 Virtualization registers on page B1-178. 

e B1.29 AArch32 GIC system registers on page B1-179. 

¢ B1.30 AArch32 Generic Timer registers on page B1-181. 

e B1.31 AArch32 Implementation defined registers on page B1-182. 


The following table describes the column headings in the CP15 register summary tables used throughout 
this section. 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-146 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.1 AArch32 register summary 


Table B1-1 System register field values 









































Heading |Description 

CRn System control primary register number. 

Opl Arguments to the register access instruction. 

CRm 

Op2 

Name The name of the register or operation. Some assemblers support aliases that you can use to access the registers and 
operations by name. 

Reset Reset value of register. 

Description | Cross-reference to the register description. 
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B1 AArch32 system registers 
B1.2 c0 registers 




































































B1.2 c0 registers 
The processor can access different 32-bit wide system registers. Registers where CRn has the value zero 
are called c0 registers. 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c0. 
Table B1-2 c0 register summary 
Op1 | CRm | Op2 | Name Reset Description 
0 c0 0 MIDR 0x410FD042 | B/.96 Main ID Register on page B1-301 
1 CTR 0x84448004 | B1.46 Cache Type Register on page B1-209 
2 TCMTR 0x00000000 | B1.108 TCM Type Register on page B1-326 
3 TLBTR 0x00000000 | B1.109 TLB Type Register on page B1-327 
4,7 |MIDR 0x410FD042 | Aliases of Main ID Register, B/.96 Main ID Register on page B1-301 
5 MPIDR - B1.97 Multiprocessor Affinity Register on page B1-303 
The reset value depends on the primary inputs, CLUSTERIDAFF 1 and 
CLUSTERIDAFF2, and the number of cores that the device implements. 
6 REVIDR 0x00000000 | B/.102 Revision ID Register on page B1-313 
cl 0 ID_PFRO 0x00000131 | B1.84 Processor Feature Register 0 on page B1-278 
1 ID_PFRI @x10011011 | B1.85 Processor Feature Register 1 on page B1-280 
Bits [31:28] are @x1 if the GIC CPU interface is implemented and enabled, and 
xð otherwise. 
2 ID_DFRO 0x83010066 | B/.73 Debug Feature Register 0 on page B1-256 
Bits [19:16] are @x1 if ETM is implemented, and @x@ otherwise. 
3 ID_AFRO Qx00000000 | B1.72 Auxiliary Feature Register 0 on page B1-255 
4 ID_MMER0O | 0x10201105 | B/.80 Memory Model Feature Register 0 on page B1-270 
5 ID_MMEFRI | 0x400000@0 | B1.81 Memory Model Feature Register 1 on page B1-272 
6 ID_MMER2 | 0x012600@@ | B/.82 Memory Model Feature Register 2 on page B1-274 
7 ID_MMER3 | 0x02102211 | B/.83 Memory Model Feature Register 3 on page B1-276 
c2 0 ID_ISARO |0x02101110 | B1.74 Instruction Set Attribute Register 0 on page B1-258 
1 ID_ISAR1 | @x13112111 | B1.75 Instruction Set Attribute Register 1 on page B1-260 
2 ID_ISAR2 | @x212320@42 | B/.76 Instruction Set Attribute Register 2 on page B1-262 
3 ID_ISAR3 | @x01112131 | B/.77 Instruction Set Attribute Register 3 on page B1-264 
4 ID_ISAR4 | @x0@@11142 | B/.78 Instruction Set Attribute Register 4 on page B1-266 
5 ID_ISARS | @x0@@11121 | B/.79 Instruction Set Attribute Register 5 on page B1-268 
ID_ISARS has the value 0x00010001 if the Cryptographic Extension is not 
implemented and enabled. 
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B1 AArch32 system registers 


B1.2 c0 registers 


Table B1-2 c0 register summary (continued) 























Op1 | CRm | Op2 | Name Reset Description 
1 c0 0 CCSIDR - B1.39 Cache Size ID Register on page B1-192 

1 CLIDR 0x0A200023 | B1.40 Cache Level ID Register on page B1-194 

The value is 0x09200003 if the L2 cache is not implemented. 

7 AIDR 0x80000008 | B/.34 Auxiliary ID Register on page B1-187 
2 c0 0 CSSELR 0x0000000O | B1.45 Cache Size Selection Register on page B1-207 
4 c0 0 VPIDR @x410FD042 | B1.121 Virtualization Processor ID Register on page B1-343 

5 VMPIDR - B1.120 Virtualization Multiprocessor ID Register on page B1-342 




















The reset value is the value of the Multiprocessor Affinity Register. 
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B1.3 c1 registers 
The processor can access different 32-bit wide system registers. Registers where CRn has the value one 
are called cl registers. 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is cl. 
Table B1-3 c1 register summary 
Op1 | CRm | Op2 | Name Reset Description 
0 c0 SCTLR | 0x00C50838 | B/.105 System Control Register on page B1-319 
The reset value depends on inputs, CFGTE, CFGEND, and VINITHI. The value 
listed here assumes these signals are set to LOW. 
ACTLR_ | 9x000000@O | B/.32 Auxiliary Control Register on page B1-184 
CPACR_ | 0x00000000 | B1.41 Architectural Feature Access Control Register on page B1-196 
cl SCR 0x00000808 | B1.104 Secure Configuration Register on page B1-316 
SDER 0x00000000 | B/.107 Secure Debug Enable Register on page B1-325 
NSACR_ | 0x000000@8 | B/.98 Non-Secure Access Control Register on page B1-305 
If EL3 is AArch64 then the NSACR reads as 0x@0000CEO. 
c3 SDCR 0x0000000O | B1.106 Secure Debug Control Register on page B1-323 
4 c0 HSCTLR | 0x03C50838 | B/.67 Hyp System Control Register on page B1-244 
HACTLR | 0x000000@0 | B/.55 Hyp Auxiliary Control Register on page B1-221 
cl HCR 0x00000000 | B/.61 Hyp Configuration Register on page B1-230 
HDCR @x00000806 | B1.63 Hyp Debug Control Register on page B1-238 
HCPTR | 0x@00033FF | B/.60 Hyp Architectural Feature Trap Register on page B1-227 
The reset value depends on the FPU and NEON configuration. If Advanced SIMD and 
floating-point are implemented, the reset value is 0x000033FF. If Advanced SIMD 
and floating-point are not implemented, the reset value is @xQ@QOOBFFF. 
HSTR 0x00000000 | B1.69 Hyp System Trap Register on page B1-249 
HCR2 0x00000000 | B1.62 Hyp Configuration Register 2 on page B1-236 
HACR 0x00000000 | B1.54 Hyp Auxiliary Configuration Register on page B1-220 
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B1.4 c2 registers 


B1.4 c2 registers 


The processor can access different 32-bit wide system registers. Registers where CRn has the value two 
are called c2 registers. 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c2. 


Table B1-4 c2 register summary 











Op1 | CRm | Op2 | Name | Reset Description 
0 c0 0 TTBRO | UNK B1.113 Translation Table Base Register 0 on page B1-333 
1 TTBRI | UNK B1.116 Translation Table Base Register 1 on page B1-337 





2: TTBCR | 0x00000000 | B/.1/0 Translation Table Base Control Register on page B1-328 


The reset value is @x000000@0 for the Secure copy of the register. The reset value for 
the EAE bit of the Non-secure copy of the register is @x@. You must program the Non- 
secure copy of the register with the required initial value, as part of the processor boot 



































sequence. 
4 c0 2 HTCR | UNK B1.70 Hyp Translation Control Register on page B1-252 
cl 2 VTCR | UNK B1.122 Virtualization Translation Control Register on page B1-344 
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B1.5 c3 registers 


The processor can access different 32-bit wide system registers. Registers where CRn has the value three 
are called c3 registers. 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c3. 


Table B1-5 c3 register summary 





Op1 | CRm | Op2 | Name | Reset | Description 





0 c0 0 DACR| UNK |B1.47 Domain Access Control Register on page B1-211 
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B1 AArch32 system registers 
B1.6 c4 registers 


The processor can access different 32-bit wide system registers. Registers where CRn has the value four 


are called c4 registers. 


The following table shows the 32-bit wide system registers you can access when the processor is in 


AArch32 state and the value of CRn is c4. 


Table B1-6 c4 register summary 





Op1 


CRm 


Op2 


Name 


Reset 


Description 











c6 








ICC PMR 





0x00000000 





Priority Mask Register 
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B1 AArch32 system registers 
B1.7 c5 registers 


The processor can access different 32-bit wide system registers. Registers where CRn has the value five 
are called c5 registers. 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c5. 


Table B1-7 c5 register summary 












































Op1 | CRm | Op2 | Name Reset Description 
0 c0 0 DFSR UNK B1.49 Data Fault Status Register on page B1-213 
1 IFSR UNK B1.87 Instruction Fault Status Register on page B1-283 
cl 0 ADFSR_ | 0x000000@0 | B/.33 Auxiliary Data Fault Status Register on page B1-186 
1 AIFSR 0x800000080 | B/.35 Auxiliary Instruction Fault Status Register on page B1-188 
4 cl 0 HADFSR | 0x00000000 | B/.56 Hyp Auxiliary Data Fault Status Syndrome Register on page B1-223 
1 HAIFSR | 0x000000@0 | B1.57 Hyp Auxiliary Instruction Fault Status Syndrome Register on page B1-224 
c2 0 HSR UNK B1.68 Hyp Syndrome Register on page B1-248 
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B1 AArch32 system registers 
B1.8 c6 registers 


The processor can access different 32-bit wide system registers. Registers where CRn has the value six 
are called c6 registers. 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c6. 


Table B1-8 c6 register summary 















































Op1 | CRm | Op2 | Name | Reset | Description 

0 c0 0 DFAR |UNK | 81.48 Data Fault Address Register on page B1-212 
2 IFAR | UNK | 8B1.86 Instruction Fault Address Register on page B1-282 

4 c0 0 HDFAR | UNK_ | 81.64 Hyp Data Fault Address Register on page B1-241 
2 HIFAR | UNK_ | 81.65 Hyp Instruction Fault Address Register on page B1-242 
4 HPFAR | UNK_ | 81.66 Hyp IPA Fault Address Register on page B1-243 
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B1.9 c7 registers 


The processor can access different 32-bit wide system registers. Registers where CRn has the value 
seven are called c7 registers. 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c7. 


Table B1-9 c7 register summary 





Op1 | CRm | Op2 | Name | Reset | Description 





0 c4 0 PAR |UNK | 81.100 Physical Address Register on page B1-309 
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B1.10 c7 system operations 
System operations are divided into two categories. When the CRn value is c7, these operations are called 
c7 system operations. 
The following table shows the System operations when CRn is c7 and the processor is in AArch32 state. 
See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile. for more 
information about these operations. 
Table B1-10 c7 System operation summary 
op1 | CRm | op2 | Name Description 
0 cl 0 ICIALLUIS | Invalidate all instruction caches Inner Shareable to POU 
PoU = Point of Unification. PoU is set by the BROADCASTINNER signal and can be in the L1 
data cache or outside of the processor, in which case PoU is dependent on the external memory 
system. 
6 BPIALLIS Invalidate all entries from branch predictors Inner Shareable 
c5 0 ICIALLU Invalidate all Instruction Caches to PoU 
1 ICIMVAU Invalidate Instruction Caches by VA to PoU 
4 CP15ISB Instruction Synchronization Barrier operation, this operation is deprecated in ARMv8-A 
6 BPIALL Invalidate all entries from branch predictors 
7 BPIMVA Invalidate VA from branch predictors 
c6 1 DCIMVAC Invalidate data cache line by VA to PoC 
PoC = Point of Coherence. The PoC is always outside of the processor and is dependent on the 
external memory system. 
2 DCISW Invalidate data cache line by set/way 
c8 0 ATS1CPR Stage 1 current state PL1 read 
1 ATS1CPW Stage 1 current state PL1 write 
2 ATS1CUR Stage | current state unprivileged read 
3 ATS1CUW Stage 1 current state unprivileged write 
4 ATS12NSOPR | Stages 1 and 2 Non-secure only PL1 read 
5 ATS12NSOPW | Stages 1 and 2 Non-secure only PL1 write 
6 ATS12NSOUR | Stages 1 and 2 Non-secure only unprivileged read 
7 ATS12NSOUW | Stages 1 and 2 Non-secure only unprivileged write 
cl0 |1 DCCMVAC Clean data cache line by VA to PoC 
2 DCCSW Clean data cache line by set/way 
4 CP15DSB Data Synchronization Barrier operation, this operation is deprecated in ARMv8-A 
5 CP15DMB Data Memory Barrier operation, this operation is deprecated in ARMv8-A 
cll 1 DCCMVAU Clean data cache line by VA to PoU 
cl4 |1 DCCIMVAC Clean and invalidate data cache line by VA to PoC 
2 DCCISW Clean and invalidate data cache line by set/way 
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Table B1-10 c7 System operation summary (continued) 


























op1 | CRm | op2 | Name Description 
4 c8 0 ATS1HR Stage 1 Hyp mode read 
1 ATS1HW Stage 1 Hyp mode write 
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B1.11 c8 system operations 















































B1.11 c8 system operations 
System operations are divided into two categories. When the CRn value is c8, these operations are called 
c8 system operations. 
The following table shows the System operations when CRn is c8 and the processor is in AArch32 state. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about these operations. 
Table B1-11 c8 System operations summary 
op1 | CRm | op2 | Name Description 
0 c3 0 TLBIALLIS Invalidate entire TLB Inner Shareable 
1 TLBIMVAIS Invalidate unified TLB entry by VA and ASID Inner Shareable 
2 TLBIASIDIS Invalidate unified TLB by ASID match Inner Shareable 
3 TLBIMVAAIS Invalidate unified TLB entry by VA all ASID Inner Shareable 
5 TLBIMVALIS Invalidate unified TLB entry by VA Inner Shareable, Last level 
7 TLBIMVAALIS Invalidate unified TLB by VA all ASID Inner Shareable, Last level 
c5 0 ITLBIALL Invalidate instruction TLB 
1 ITLBIMVA Invalidate instruction TLB entry by VA and ASID 
2 ITLBIASID Invalidate instruction TLB by ASID match 
c6 0 DTLBIALL Invalidate data TLB 
1 DTLBIMVA Invalidate data TLB entry by VA and ASID 
2 DTLBIASID Invalidate data TLB by ASID match 
c7 0 TLBIALL Invalidate unified TLB 
1 TLBIMVA Invalidate unified TLB by VA and ASID 











2 TLBIASID 


Invalidate unified TLB by ASID match 





3 TLBIMVAA 


Invalidate unified TLB entries by VA all ASID 





5 TLBIMVAL 


Invalidate last level of stage 1 TLB entry by VA 











7 TLBIMVAAL 





Invalidate last level of stage 1 TLB entry by VA all ASID 
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B1.11 c8 system operations 


Table B1-11 c8 System operations summary (continued) 
























































op1 | CRm | op2 | Name Description 
4 c0 1 TLBIIPAS2I1S TLB Invalidate entry by Intermediate Physical Address, Stage 2, Inner Shareable 
5 TLBIIPAS2LIS | TLB Invalidate entry by Intermediate Physical Address, Stage 2, Last level, Inner Shareable 
c3 0 TLBIALLHIS Invalidate entire Hyp unified TLB Inner Shareable 
1 TLBIMVAHIS Invalidate Hyp unified TLB entry by VA Inner Shareable 
4 TLBIALLNSNHTIS | Invalidate entire Non-secure non-Hyp unified TLB Inner Shareable 
5 TLBIMVALHIS Invalidate Unified Hyp TLB entry by VA Inner Shareable, Last level 
c4 1 TLBIIPAS2 TLB Invalidate entry by Intermediate Physical Address, Stage 2 
5 TLBIIPAS2L TLB Invalidate entry by Intermediate Physical Address, Stage 2, Last level 
c7 0 TLBIALLH Invalidate entire Hyp unified TLB 
1 TLBIMVAH Invalidate Hyp unified TLB entry by VA 
4 TLBIALLNSNH Invalidate entire Non-secure non-Hyp unified TLB 
5 TLBIMVALH Invalidate Unified Hyp TLB entry by VA, Last level 
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B1.12 c9 registers 
The processor can access different 32-bit wide system registers. Registers where CRn has the value nine 
are called c9 registers. 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c9. See the ARM® Architecture Reference Manual ARMv8, for 
ARMv8-A architecture profile for more information. 
Table B1-12 c9 register summary CRn=c9 
Op1 | CRm | Op2 | Name Reset Description 
0 cl2 JO PMCR 0x410A3000 | C10.6 Performance Monitors Control Register, ELO on page C10-674 
1 PMNCNTENSET | UNK Performance Monitors Count Enable Set Register 
2 PMNCNTENCLR | UNK Performance Monitors Count Enable Clear Register 
3 PMOVSR UNK Performance Monitor Overflow Flag Status Clear Register 
4 PMSWINC UNK Performance Monitors Software Increment Register 
5 PMSELR UNK Performance Monitors Event Counter Selection Register 
6 PMCEIDO @x6FFFBFFF | C10.3 Performance Monitors Common Event Identification Register 0 
on page C10-667 
The reset value is OX6E3FBFFF if L2 cache is not implemented. 
7 PMCEID1 0x00000000 | C10.4 Performance Monitors Common Event Identification Register 1 
on page C10-671 
c13 JO PMCCNTR UNK Performance Monitors Cycle Counter 
1 PMXEVTYPER | UNK Performance Monitors Selected Event Type and Filter Register 
2 PMXEVCNTR UNK Performance Monitors Selected Event Counter Register 
cl4 |0 PMUSERENR @x8008008 | Performance Monitors User Enable Register 
1 PMINTENSET UNK Performance Monitors Interrupt Enable Set Register 
2 PMINTENCLR UNK Performance Monitors Interrupt Enable Clear Register 
3 PMOVSSET UNK Performance Monitor Overflow Flag Status Set Register 
1 c0 2 L2CTLR - B1.92 L2 Control Register on page B1-291 
The reset value depends on the processor configuration. 
3 L2ECTLR 0xX00000000 | B1.93 L2 Extended Control Register on page B1-293 
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B1.13 c10 registers 
The processor can access different 32-bit wide system registers. Registers where CRn has the value ten 
are called c10 registers. 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c10. 
Table B1-13 c10 register summary 
Op1 | CRm | Op2 | Name Reset Description 
0 c2 0 PRRR UNK B1.101 Primary Region Remap Register on page B1-310 
0 MAIRO UNK B1.95 Memory Attribute Indirection Registers 0 and 1 on page B1-298 
1 NMRR UNK B1.99 Normal Memory Remap Register on page B1-307 
1 MAIRI UNK B1.95 Memory Attribute Indirection Registers 0 and 1 on page B1-298 
c3 0 AMAIRO |0x00000000 | B/.36 Auxiliary Memory Attribute Indirection Register 0 on page B1-189 
1 AMAIRI |@0x00000000 | B1.37 Auxiliary Memory Attribute Indirection Register 1 on page B1-190 
4 c2 0 HMAIRO | UNK Hyp Memory Attribute Indirection Register 0 
See the ARM” Architecture Reference Manual ARMv8, for ARMv8-A architecture 
profile for more information. 
1 HMAIRI | UNK Hyp Memory Attribute Indirection Register 1 
See the ARM” Architecture Reference Manual ARMVv8, for ARMv8-A architecture 
profile for more information. 
c3 0 HAMAIRO | 0x@@000088 | B1.58 Hyp Auxiliary Memory Attribute Indirection Register 0 on page B1-225 
1 HAMAIRI | 0x00000000 | B1.59 Hyp Auxiliary Memory Attribute Indirection Register 1 on page B1-226 
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B1.14 c11 registers 


There are no system registers to access when the processor is in AArch32 state and the value of CRn is 
11. 
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B1.15 c12 registers 












































B1.15 c12 registers 
The processor can access different 32-bit wide system registers. Registers where CRn has the value 
twelve are called c12 registers. 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c12. 
Table B1-14 c12 register summary 
Op1 | CRm | Op2 | Name Reset Description 
0 c0 0 VBAR 0x00000000 | B1.119 Vector Base Address Register on page B1-341. @x8000008O is the 
secure reset value and UNK is the non-secure reset value. 
1 MVBAR UNK Monitor Vector Base Address Register. See the ARM” Architecture Reference 
Manual ARMVv8, for ARMv8-A architecture profile for more information. 
2 RMR 0x00000000 | B/./03 Reset Management Register on page B1-314. 
cl 0 ISR UNK B1.90 Interrupt Status Register on page B1-287. 
c8 0 ICC_IARO - Interrupt Acknowledge Register 0 
1 ICC_EOIRO - End Of Interrupt Register 0 
2 ICC_HPPIRO - Highest Priority Pending Interrupt Register 0 
3 ICC_BPRO 0x00000002 | Binary Point Register 0 
4 ICC_APORO @x8008008 | Active Priorities 0 Register 0 
c9 0 ICC_AP1RO 0xX0000000O | Active Priorities 1 Register 0 
cll 1 ICC_DIR - Deactivate Interrupt Register 
3 ICC_RPR - Running Priority Register 
cl2 JO ICC_IARI - Interrupt Acknowledge Register 1 
1 ICC_EOIR1 - End Of Interrupt Register 1 
2 ICC_HPPIR1 - Highest Priority Pending Interrupt Register 1 
3 ICC_BPR1 0x00000003 | Binary Point Register 1 
This is the reset value in non-secure state. In secure state, the reset value is 
0x00000002. 
4 ICC_CTLR 0x00000400 | Interrupt Control Register 
5 ICC_SRE 0xX00000000 | System Register Enable Register 
6 ICC_IGRPENO | 0x00000@8 | Interrupt Group Enable Register 0 
7 ICC_IGRPEN1 | 0x00000@@8 | Interrupt Group Enable Register 1 
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B1.15 c12 registers 


Table B1-14 c12 register summary (continued) 



















































































Op1 | CRm | Op2 | Name Reset Description 
4 c0 0 HVBAR UNK B1.71 Hyp Vector Base Address Register on page B1-254. 
c8 0 ICH_APORO Qx800808O | Interrupt Controller Hyp Active Priorities Register (0,0) 
c9 0 ICH_AP1IRO @x8008008 | Interrupt Controller Hyp Active Priorities Register (1,0) 
4 ICH_VSEIR 0XxX0000000O | Interrupt Controller Virtual System Error Interrupt Register 
5 ICC_HSRE 0xX0000000O | System Register Enable Register for EL2 
cll JO ICH_HCR @x80080088 | Interrupt Controller Hyp Control Register 
1 ICH_VTR 0x90080003 | Interrupt Controller VGIC Type Register 
2 ICH_MISR @x8008808 | Interrupt Controller Maintenance Interrupt State Register 
3 ICH_EISR Qx800808O | Interrupt Controller End of Interrupt Status Register 
7 ICH_VMCR @x804C80O | Interrupt Controller Virtual Machine Control Register 
5 ICH_ELRSR 0xX000000OF | Interrupt Controller Empty List Register Status Register 
cl2 JO ICH_LRO @x8008808 | Interrupt Controller List Register 0 
1 ICH_LR1 @x80088288 | Interrupt Controller List Register 1 
2 ICH_LR2 Qx800008O | Interrupt Controller List Register 2 
3 ICH_LR3 @x8008008 | Interrupt Controller List Register 3 
cl4 |0 ICH_LRCO Qx800808O | Interrupt Controller List Register 0 
1 ICH_LRC1 @x80080088 | Interrupt Controller List Register 1 
2 ICH_LRC2 @x8008808 | Interrupt Controller List Register 2 
3 ICH_LRC3 0xX0000000O | Interrupt Controller List Register 3 
6 cl2 |4 ICC_MCTLR 0x00000400 | Interrupt Control Register for EL3 
5 ICC_MSRE 0X0000000O | System Register Enable Register for EL3 
7 ICC_MGRPEN|1 | 0x00000000 | Interrupt Controller Monitor Interrupt Group 1 Enable register 
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B1.16 c13 registers 


The processor can access different 32-bit wide system registers. Registers where CRn has the value 
thirteen are called c13 registers. 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c13. 


For information on all registers but FCSE Process ID, see the ARM" Architecture Reference Manual 
ARMV6, for ARMV8-A architecture profile. 


Table B1-15 c13 register summary 
























































Op1 | CRm | Op2 | Name Reset Description 

0 c0 0 FCSEIDR 0x00000000 | B1.53 FCSE Process ID Register on page B1-219 
1 CONTEXTIDR | UNK Context ID Register 
2 TPIDRURW UNK User Read/Write Thread ID Register 
3 TPIDRURO UNK User Read-Only Thread ID Register 
4 TPIDRPRW UNK EL1 only Thread ID Register 

4 c0 2 HTPIDR UNK Hyp Software Thread ID Register 
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B1.17 c14 registers 


The processor can access different 32-bit wide system registers. Registers where CRn has the value 
fourteen are called c14 registers. 


The following table shows the CP15 system registers when the processor is in AArch32 state and the 
value of CRn is c14. See the ARM® Architecture Reference Manual ARMv6, for ARMv8-A architecture 
profile for more information. 


Table B1-16 c14 register summary 





Op1 | CRm | Op2 | Name Reset Description 





0 c0 0 CNTFRQ UNK Timer Counter Frequency Register 





cl 0 CNTKCTL 


Timer Control Register 


The reset value for bits[9:8, 2:0] is @b00000. 





c2 0 CNTP_TVAL | UNK Physical Timer Value Register 





1 CNTP_CTL 


Physical Timer Control Register 


The reset value for bit[0] is 0. 





c3 0 CNTV_TVAL | UNK Virtual Timer TimerValue Register 











1 CNTV_CTL - Counter-timer Virtual Timer Control Register 


The reset value for bit[0] is 0. 
























































c8 0 PMEVCNTRO | UNK Performance Monitor Event Count Registers 
1 PMEVCNTRI | UNK 
2 PMEVCNTR2 | UNK 
3 PMEVCNTR3 | UNK 
4 PMEVCNTR4 | UNK 
5 PMEVCNTRS | UNK 
c12 JO PMEVTYPERO | UNK Performance Monitor Event Type Registers 
1 PMEVTYPERI | UNK 
2 PMEVTYPER2 | UNK 
3 PMEVTYPER3 | UNK 
4 PMEVTYPER4 | UNK 
5 PMEVTYPERS | UNK 
c15 |7 PMCCFILTR |@0x00000000 | Performance Monitor Cycle Count Filter Register. 








4 cl 0 CNTHCTL 


Timer Control Register (EL2) 
The reset value for bit[2] is 0 and for bits[1:0] is @b11. 





c2 0 CNTHP_TVAL | UNK Physical Timer TimerValue (EL2) 





1 CNTHP_CTL Physical Timer Control Register (EL2) 


The reset value for bit[0] is 0. 
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B1.18 c15 registers 
The processor can access different 32-bit wide system registers. Registers where CRn has the value 
fifteen are called c15 registers. 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c15. 
Table B1-17 c15 register summary 
Op1 | CRm | Op2 | Name Reset Description 
1 c0 0 L2ACTLR | 0x800000@@ | B/.9/ L2 Auxiliary Control Register on page B1-289 
This is the reset value for an ACE interface. For an AXI interface the reset value is 
@x80000008. For a CHI interface the reset value is @x80004008. 
c3 0 CBAR - B1.38 Configuration Base Address Register on page B1-191 
The reset value depends on the processor configuration. 
3 c0 0 CDBGDRO | UNK Cache Debug Data Register 0, see C5. 1 About direct access to internal memory 
on page C5-582 
1 CDBGDR1 | UNK Cache Debug Data Register 1, see C5. 7 About direct access to internal memory 
on page C5-582 
2 CDBGDR2 | UNK Cache Debug Data Register 2, see C5. 1 About direct access to internal memory 
on page C5-582 
3 CDBGDR3 | UNK Cache Debug Data Register 3, see C5. 1 About direct access to internal memory 
on page C5-582 
c2 0 CDBGDCT | UNK Cache Debug Data Cache Tag Read Operation Register, see C5.7 About direct 
access to internal memory on page C5-582 
1 CDBGICT |UNK Cache Debug Instruction Cache Tag Read Operation Register, see C5. 7 About direct 
access to internal memory on page C5-582 
c4 0 CDBGDCD | UNK Cache Debug Cache Debug Data Cache Data Read Operation Register, see 
C5.1 About direct access to internal memory on page C5-582 
1 CDBGICD | UNK Cache Debug Instruction Cache Data Read Operation Register, see C5. 7 About 
direct access to internal memory on page C5-582 
2 CDBGTD  |UNK Cache Debug TLB Data Read Operation Register, see C5./ About direct access to 
internal memory on page C5-582 
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64-bit registers 


B1 AArch32 system registers 
B1.19 64-bit registers 


The processor can access 64-bit wide CP15 system registers in AArch32 state. 


The following table shows the 64-bit wide CP15 system registers, accessed by the MCRR and MRRC 
instructions. See the ARM® Architecture Reference Manual ARMvé6, for ARMv8-A architecture profile for 
more information. 


Table B1-18 64-bit register summary 













































































Op1 | CRm | Name Reset Description 

0 c2 TTBRO UNK Translation Table Base Register 0 

1 c2 TTBR1 UNK Translation Table Base Register 1 

4 c2 HTTBR UNK Hyp Translation Table Base Register 

6 c2 VTTBR UNK Virtualization Translation Table Base Register 

0 c7 PAR UNK B1.100 Physical Address Register on page B1-309 

0 c14 | CNTPCT UNK Physical Timer Count Register 

1 c14 | CNTVCT UNK Virtual Timer Count Register 

2 cl4 |CNTP_CVAL | UNK Physical Timer CompareValue Register 

3 cl4 |CNTV_CVAL | UNK Virtual Timer CompareValue Register 

4 c14 | CNTVOFF UNK Virtual Timer Offset Register 

6 c14 | CNTHP_CVAL | UNK Physical Timer CompareValue Register 

0 c15 | CPUACTLR 0x80088808890CAGBOO | B/.42 CPU Auxiliary Control Register on page B1-198 

1 clS | CPUECTLR 0x000000000000000O | B/.43 CPU Extended Control Register on page B1-202 

2 c15  |CPUMERRSR |- B1.44 CPU Memory Error Syndrome Register on page B1-204 
3 c15 |L2MERRSR - B1.94 L2 Memory Error Syndrome Register on page B1-295 
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B1 AArch32 system registers 
B1.20 AArch32 Identification registers 












































































































































B1.20 AArch32 Identification registers 
The following table shows the identification registers. 
Table B1-19 Identification registers 

Name CRn | Op1 | CRm | Op2 | Reset Description 

MIDR c0 0 c0 0 0x410FD042 | B/.96 Main ID Register on page B1-301 

CTR 1 0x84448004 | B1.46 Cache Type Register on page B1-209 

TCMTR 2 0x00000000 | B1.108 TCM Type Register on page B1-326 

TLBTR 3 0x00000000 | B1.109 TLB Type Register on page B1-327 

MPIDR 5 - B1.97 Multiprocessor Affinity Register on page B1-303 
The reset value depends on the primary inputs, CLUSTERIDAFF1 and 
CLUSTERIDAFF?2, and the number of cores that the device implements. 

REVIDR 6 0x00000000 | B1.102 Revision ID Register on page B1-313 

ID_PFRO cl 0 0x00000131 | B1.84 Processor Feature Register 0 on page B1-278 

ID_PFRI 1 0x10011011 | B1.85 Processor Feature Register I on page B1-280 
Bits [31:28] are @x1 if the GIC CPU interface is implemented and enabled, 
and x@ otherwise. 

ID_DFRO 2 Qx03010066 | B/.73 Debug Feature Register 0 on page B1-256 
Bits [19:16] are @x1 if ETM is implemented, and @x@ otherwise. 

ID_AFRO 3 0x00000000 | B1.72 Auxiliary Feature Register 0 on page B1-255 

ID_MMFRO 4 @x102011@5 | B/.80 Memory Model Feature Register 0 on page B1-270 

ID_MMEFRI1 5 0x40000000 | B1.81 Memory Model Feature Register 1 on page B1-272 

ID_MMFR2 6 0x01260000 | B1.82 Memory Model Feature Register 2 on page B1-274 

ID_MMFR3 7 @x@2102211 | B/.83 Memory Model Feature Register 3 on page B1-276 

ID_ISARO c2 0 0x021011190 | B1.74 Instruction Set Attribute Register 0 on page B1-258 

ID_ISAR1 1 @x13112111 | B1.75 Instruction Set Attribute Register 1 on page B1-260 

ID_ISAR2 2 @x21232042 | B1.76 Instruction Set Attribute Register 2 on page B1-262 

ID_ISAR3 3 @x@1112131 | B1.77 Instruction Set Attribute Register 3 on page B1-264 

ID_ISAR4 4 0x00011142 | B1.78 Instruction Set Attribute Register 4 on page B1-266 

ID_ISAR5 | c0 0 c2 5 0x00011121 | B1.79 Instruction Set Attribute Register 5 on page B1-268 
ID_ISARS has the value @x00010001 if the Cryptographic Extension is not 
implemented and enabled. 

CCSIDR 1 c0 0 - B1.39 Cache Size ID Register on page B1-192 

CLIDR 1 0x0A200023 | B1.40 Cache Level ID Register on page B1-194 
The value is 0x09200003 if the L2 cache is not implemented. 

AIDR 7 0x000000@8 | B/.34 Auxiliary ID Register on page B1-187 

CSSELR 2 c0 0 0x0000000O | B1.45 Cache Size Selection Register on page B1-207 
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B1 AArch32 system registers 
B1.21 AArch32 Virtual memory control registers 





































































































B1.21 AArch32 Virtual memory control registers 
The following table shows the virtual memory control registers. 
Table B1-20 Virtual memory control registers 

Name CRn | Op1 | CRm | Op2 | Reset Width | Description 

SCTLR cl 0 c0 0 @x@0C50838 | 32-bit | B/.105 System Control Register on page B1-319 
The reset value depends on inputs, CFGTE, CFGEND, and 
VINITHL The value listed here assumes these signals are set to 
LOW. 

TTBRO c2 0 c0 0 UNK 32-bit | Translation Table Base Register 0, see B/.113 Translation Table 

p 0 2 - 64-bit Base Register 0 on page B1-333 

TTBR1 c2 0 c0 1 UNK 32-bit | Translation Table Base Register 1, see B/.116 Translation Table 

Base Register 1 B1- 
- 1 2 i 64-bit ase Register 1 on page 337 

TTBCR c2 0 c0 2 @x800000@8 | 32-bit | B1.110 Translation Table Base Control Register on page B1-328 
The reset value is @x@0000000 for the Secure copy of the 
register. The reset value for the EAE bit of the Non-secure copy 
of the register is @x®. You must program the Non-secure copy of 
the register with the required initial value, as part of the 
processor boot sequence. 

DACR c3 0 c0 0 UNK 32-bit | B1.47 Domain Access Control Register on page B1-211 

PRRR c10 |0 c2 0 UNK 32-bit | B1.101 Primary Region Remap Register on page B1-310 

MAIRO 0 UNK 32-bit | B1.95 Memory Attribute Indirection Registers 0 and 1 
on page B1-298 

NMRR 1 UNK 32-bit | B1.99 Normal Memory Remap Register on page B1-307 

MAIRI 1 UNK 32-bit | B1.95 Memory Attribute Indirection Registers 0 and 1 
on page B1-298 

AMAIRO c3 0 0x000000OO | 32-bit | B1.36 Auxiliary Memory Attribute Indirection Register 0 
on page B1-189 

AMAIR1 1 0x000000@8 | 32-bit | B1.37 Auxiliary Memory Attribute Indirection Register 1 
on page B1-190 

CONTEXTIDR |c13 |0 c0 1 UNK 32-bit | Process ID Register, see the ARM” Architecture Reference 
Manual ARMVv8, for ARMv8-A architecture profile 
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B1 AArch32 system registers 
B1.22 AArch32 Fault handling registers 


B1.22 AArch32 Fault handling registers 


The following table shows the Fault handling registers in the AArch32 Execution state. 


Table B1-21 Fault handling registers 
























































Name |CRn | Op1|CRm | Op2 | Reset Description 

DFSR_ | c5 0 c0 0 UNK B1.49 Data Fault Status Register on page B1-213 

IFSR 1 UNK B1.87 Instruction Fault Status Register on page B1-283 

ADFSR cl 0 0x000000080 | B1.33 Auxiliary Data Fault Status Register on page B1-186 

AIFSR 1 0x000008080 | B1.35 Auxiliary Instruction Fault Status Register on page B1-188 

DFAR_ | c6 0 c0 0 UNK Data Fault Address Register, see the ARM” Architecture Reference Manual 
ARMV8, for ARMv8-A architecture profile 

IFAR 2 UNK Instruction Fault Address Register, see the ARM” Architecture Reference Manual 


ARMV8, for ARMv8-A architecture profile 








The Virtualization registers include additional fault handling registers. See B/.28 AArch32 Virtualization 
registers on page B1-178 for more information. 
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B1 AArch32 system registers 
B1.23 AArch32 Other System control registers 


B1.23  AArch32 Other System control registers 
The following table shows the other system registers. 


Table B1-22 Other system registers 





Name CRn | Op1 | CRm | Op2 | Reset Description 





ACTLR fcl 0 c0 1 0x00000000 | B/.32 Auxiliary Control Register on page B1-184 








CPACR 2 0x800008008 | B1.41 Architectural Feature Access Control Register on page B1-196 





FCSEIDR | c13_ |0 c0 0 0x00000000 | B/.53 FCSE Process ID Register on page B1-219 
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B1.24 AArch32 Address registers 
The following table shows the address translation register and operations. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 


B1 AArch32 system registers 
B1.24 AArch32 Address registers 















































information. 
Table B1-23 Address translation operations 
Name | CRn | Op1 | CRm | Op2 | Reset | Width | Description 
PAR |c7 0 c4 0 UNK | 32-bit | B/.100 Physical Address Register on page B1-309 
- 0 c7 - 64-bit 
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B1.25 AArch32 Thread registers 
The following table shows the miscellaneous operations. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 


information. 


B1 AArch32 system registers 
B1.25 AArch32 Thread registers 


Table B1-24 Miscellaneous System instructions 












































Name CRn | Op1 | CRm | Op2 | Reset | Description 

TPIDRURW |c13 | 0 c0 2 UNK | User Read/Write Thread ID Register 
TPIDRURO 3 UNK | User Read-Only Thread ID Register 
TPIDRPRW 4 UNK | EL1 only Thread ID Register 
HTPIDR 4 c0 2 UNK |Hyp Software Thread ID Register 
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B1.26 AArch32 Performance monitor registers 


B1.26 AArch32 Performance monitor registers 


The following table shows the performance monitor registers. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 


Table B1-25 Performance monitor registers 












































































































































































































































Name CRn | Op1 | CRm | Op2 | Reset Description 

PMCR c9 0 cl2 JO 0x410A3000 | C10.2 Performance Monitors Control Register on page C10-664 

PMCNTENSET 1 UNK Performance Monitors Count Enable Set Register 

PMCNTENCLR 2 UNK Performance Monitors Count Enable Clear Register 

PMOVSR 3 UNK Performance Monitors Overflow Flag Status Register 

PMSWINC 4 UNK Performance Monitors Software Increment Register 

PMSELR 5 UNK Performance Monitors Event Counter Selection Register 

PMCEIDO 6 @x6FFFBFFF | C/0.3 Performance Monitors Common Event Identification Register 0 
on page C10-667 
The reset value is @X6E3FBFFF if L2 cache is not implemented. 

PMCEID1 7 0x00000000 | C10.4 Performance Monitors Common Event Identification Register 1 
on page C10-671 

PMCCNTR cl3 JO UNK Performance Monitors Cycle Count Register 

PMXEVTYPER 1 UNK Performance Monitors Selected Event Type Register 

PMXEVCNTR 2 UNK Performance Monitors Event Count Registers 

PMUSERENR cl4 JO 0x00000000 | Performance Monitors User Enable Register 

PMINTENSET 1 UNK Performance Monitors Interrupt Enable Set Register 

PMINTENCLR 2 UNK Performance Monitors Interrupt Enable Clear Register 

PMOVSSET 3 UNK Performance Monitor Overflow Flag Status Set Register 

PMEVCNTRO |cl4 |0 c8 0 UNK Performance Monitors Event Count Register 0 

PMEVCNTR1 1 UNK 

PMEVCNTR2 2 UNK 

PMEVCNTR3 3 UNK 

PMEVCNTR4 4 UNK 

PMEVCNTR5 5 UNK 

PMEVTYPERO c12 JO UNK Performance Monitors Selected Event Type Register 0 

PMEVTYPER1 1 UNK 

PMEVTYPER2 2 UNK 

PMEVTYPER3 3 UNK 

PMEVTYPER4 4 UNK 

PMEVTYPER5 5 UNK 

PMCCFILTR c15 |7 0x00000000 | Performance Monitors Cycle Count Filter Register 

ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-176 


reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.27 AArch32 Secure registers 


B1.27 AArch32 Secure registers 
The following table shows the Secure registers. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 


Table B1-26 Security registers 





Name |CRn |Op1 |CRm | Op2 | Reset Description 





SCR cl 0 cl 0 0x00000000 | B/.104 Secure Configuration Register on page B1-316 








SDER 1 UNK Secure Debug Enable Register 








NSACR 2 @x800000@80 | B/.98 Non-Secure Access Control Register on page B1-305 
If EL3 is AArch64, then the NSACR reads as OXOOOOOCOOA. 





VBAR /|cl2 |0 c0 0 0x000000@8 | B/.119 Vector Base Address Register on page B1-3410x000000@O is the secure 
reset value and UNK is the non-secure reset value. 












































MVBAR 1 UNK Monitor Vector Base Address Register 

ISR cl 0 UNK Interrupt Status Register 
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B1 AArch32 system registers 
B1.28 AArch32 Virtualization registers 




















































































































B1.28 AArch32 Virtualization registers 
The following table shows the Virtualization registers. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 
Table B1-27 Virtualization registers 
Name CRn | Op1 | CRm | Op2 | Reset Width | Description 
VPIDR c0 4 c0 0 0x410FD042 | 32-bit | B1.121 Virtualization Processor ID Register on page B1-343 
VMPIDR 5 - 32-bit | B1.120 Virtualization Multiprocessor ID Register on page B1-342 
The reset value is the value of the Multiprocessor Affinity Register. 
HSCTLR {cl 4 c0 0 @x30C50838 | 32-bit | B1.67 Hyp System Control Register on page B1-244 
HACTLR 1 UNK B1.55 Hyp Auxiliary Control Register on page B1-221 
HCR cl 0 Qx000080@8 | 32-bit | Hyp Configuration Register 
HDCR 1 0x000080@6 | 32-bit | B/.63 Hyp Debug Control Register on page B1-238 
HCPTR 2 0x000033FF | 32-bit | B/.60 Hyp Architectural Feature Trap Register on page B1-227 
The reset value depends on the FPU and NEON configuration. If 
Advanced SIMD and floating-point are implemented, the reset value 
is @x000033FF. If Advanced SIMD and floating-point are not 
implemented, the reset value is @xO@QQ@BFFF. 
HSTR 3 0xX0000000O | 32-bit | Hypervisor System Trap Register 
HTCR c2 4 c0 2 UNK 32-bit | B1.70 Hyp Translation Control Register on page B1-252 
VTCR cl 2 UNK 32-bit | Virtualization Translation Control Register 
HTTBR - 4 c2 - UNK 64-bit | Hyp Translation Table Base Register 
VTTBR - 6 c2 - UNK 64-bit | Virtualization Translation Table Base Register 
HADFSR j|c5 4 cl 0 0x800008@8 | 32-bit | B1.56 Hyp Auxiliary Data Fault Status Syndrome Register 
on page B1-223 
HAIFSR 1 Qx000008@8 | 32-bit | B1.57 Hyp Auxiliary Instruction Fault Status Syndrome Register 
on page B1-224 
HSR c2 0 UNK 32-bit | B1.68 Hyp Syndrome Register on page B1-248 
HDFAR c6 4 c0 0 UNK 32-bit | Hyp Data Fault Address Register 
HIFAR 2 UNK 32-bit | Hyp Instruction Fault Address Register 
HPFAR 4 UNK 32-bit | Hyp IPA Fault Address Register 
HMAIRO |clO |4 c2 0 UNK 32-bit | Hyp Memory Attribute Indirection Register 0 
HMAIR1 1 UNK 32-bit | Hyp Memory Attribute Indirection Register 1 
HAMAIRO c3 0 Qx000008@8 | 32-bit | B1.58 Hyp Auxiliary Memory Attribute Indirection Register 0 
on page B1-225 
HAMAIRI 1 0x000008@8 | 32-bit | B1.59 Hyp Auxiliary Memory Attribute Indirection Register 1 
on page B1-226 
HVBAR |cl2 |4 c0 0 UNK 32-bit | Hyp Vector Base Address Register 
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B1 AArch32 system registers 
B1.29 AArch32 GIC system registers 















































































































































B1.29 AArch32 GIC system registers 
The following table shows the GIC system registers in AArch32 state. 
See the ARM® Generic Interrupt Controller Architecture Specification, GIC architecture version 3.0 and 
version 4.0 for more information. 
Table B1-28 AArch32 GIC system registers 
Name CRn | Op1 | CRm | Op2 | Type | Reset Width | Description 
ICC_SGIIR - 0 c12 |- WO |- 64-bit | SGI Generation Register 1 
ICC_ASGIIR - 1 c12 |- WO |- 64-bit | Alternate SGI Generation Register 1 
ICC_SGIOR - 2 c12 |- WO |- 64-bit | SGI Generation Register 0 
ICC_ PMR c4 0 c6 0 RW |@0x00000000 | 32-bit | Priority Mask Register 
ICC_IARO cl2 |0 c8 0 RO |- 32-bit | Interrupt Acknowledge Register 0 
ICC_EOIRO 1 WO |- 32-bit | End Of Interrupt Register 0 
ICC_HPPIRO 2 RO |- 32-bit | Highest Priority Pending Interrupt Register 0 
ICC_BPRO 3 RW | 0x000000O2 | 32-bit | Binary Point Register 0 
ICC_APORO 4 RW _ | 0x0080088O | 32-bit | Active Priorities 0 Register 0 
ICC_AP1RO c9 0 RW _ | 0x0080088O | 32-bit | Active Priorities 1 Register 0 
ICC_DIR cll 1 WO |- 32-bit | Deactivate Interrupt Register 
ICC_RPR 3 RO |- 32-bit | Running Priority Register 
ICC_IAR1 c12 JO RO |- 32-bit | Interrupt Acknowledge Register 1 
ICC_EOIR1 1 WO |- 32-bit | End Of Interrupt Register 1 
ICC_HPPIR1 2 RO |- 32-bit | Highest Priority Pending Interrupt Register 1 
ICC_BPR1 3 RW | 0x008008O3 | 32-bit | Binary Point Register 1 
This is the reset value in non-secure state. In secure 
state, the reset value is 0x00000002. 
ICC_CTLR 4 RW | 0x000004880 | 32-bit | Interrupt Control Register 
ICC_SRE 5 RW | 0x0000088O | 32-bit | System Register Enable Register 
ICC_IGRPENO 6 RW | 0x0000008O | 32-bit | Interrupt Group Enable Register 0 
ICC_IGRPEN1 7 RW | 0x0080088O | 32-bit | Interrupt Group Enable Register 1 
ICH_APORO 4 c8 0 RW | 0x0000088O | 32-bit | Interrupt Controller Hyp Active Priorities Register (0,0) 
ICH_AP1IRO c9 0 RW | 0x0080088O | 32-bit | Interrupt Controller Hyp Active Priorities Register (1,0) 
ICC_HSRE 5 RW | 0x0080088O | 32-bit | System Register Enable Register for EL2 
ICH_HCR cll JO RW |@0x00000000 | 32-bit | Interrupt Controller Hyp Control Register 
ICH_VTR 1 RO |@©0x90080003 | 32-bit | Interrupt Controller VGIC Type Register 
ICH_MISR 2 RO |@0Xx0000000A | 32-bit | Interrupt Controller Maintenance Interrupt State 
Register 
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B1 AArch32 system registers 
B1.29 AArch32 GIC system registers 


Table B1-28 AArch32 GIC system registers (continued) 














































































































Name CRn | Op1 | CRm | Op2 | Type | Reset Width | Description 

ICH_EISR cl2 |4 c8 3 RO | 0x0080088O | 32-bit | Interrupt Controller End of Interrupt Status Register 
ICH_VMCR 7 RW | 0x004C0GOE | 32-bit | Interrupt Controller Virtual Machine Control Register 
ICH_ELRSR 5 RO | @x@G@QO@GOF | 32-bit | Interrupt Controller Empty List Register Status Register 
ICH_LRO cl2 JO RW | 0x0000088E | 32-bit | Interrupt Controller List Register 0 

ICH_LR1 1 RW | 0x0080088O | 32-bit | Interrupt Controller List Register 1 

ICH_LR2 2 RW | 0x0000088O | 32-bit | Interrupt Controller List Register 2 

ICH_LR3 3 RW | 8x0000088O | 32-bit | Interrupt Controller List Register 3 

ICH_LRCO cl4 JO RW | 0x0000088O | 32-bit | Interrupt Controller List Register 0 

ICH_LRC1 1 RW | 0x000008OO | 32-bit | Interrupt Controller List Register 1 

ICH_LRC2 2; RW | 0x0000088O | 32-bit | Interrupt Controller List Register 2 

ICH_LRC3 3 RW | 0x0000008O | 32-bit | Interrupt Controller List Register 3 

ICC_MCTLR 6 cl2 |4 RW | 0x00000480 | 32-bit | Interrupt Control Register for EL3 

ICC_MSRE 5 RW | 0x0000088O | 32-bit | System Register Enable Register for EL3 
ICC_MGRPEN1 7 RW | 0x000008OE | 32-bit | Interrupt Controller Monitor Interrupt Group 1 Enable 


register 
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B1 AArch32 system registers 
B1.30 AArch32 Generic Timer registers 


B1.30 AArch32 Generic Timer registers 
The processor implements the architecturally defined Generic Timer registers. 


The AArch32 Generic Timer registers are described in B4.2 AArch32 Generic Timer register summary 
on page B4-545. See also the ARM® Architecture Reference Manual ARMv8, for ARMv8-A architecture 
profile. for more information. 
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B1 AArch32 system registers 
B1.31 AArch32 Implementation defined registers 




















































































































B1.31 AArch32 Implementation defined registers 
IMPLEMENTATION DEFINED registers provide test features and any required configuration options specific to 
the Cortex-A35 processor. 
The following table shows the 32-bit wide implementation defined registers. 
Table B1-29 Memory access registers 

Name CRn | Op1 | CRm | Op2 | Reset Width | Description 

L2CTLR c9 1 c0 2 = 32-bit | B1.92 L2 Control Register on page B1-291 
The reset value depends on the processor 
configuration. 

L2ECTLR 3 0x00000000 32-bit | B1.93 L2 Extended Control Register on page B1-293 

L2ACTLR c15 |1 c0 0 0x80000000 32-bit | B1.91 L2 Auxiliary Control Register on page B1-289 
This is the reset value for an ACE interface. For an 
AXI interface the reset value is @x800000Q8. For a 
CHI interface the reset value is 0x80004008. 

CBAR c3 0 - 32-bit | B1.38 Configuration Base Address Register 
on page B1-191 
The reset value depends on the processor 
configuration. 

CDBGDRO 3 c0 0 UNK 32-bit | Data Register 0, see C5./ About direct access to 
internal memory on page C5-582 for information on 
how these registers are used. 

CDBGDR1 1 UNK 32-bit | Data Register 1, see C5./ About direct access to 
internal memory on page C5-582 

CDBGDR2 2 UNK 32-bit | Data Register 2, see C5./ About direct access to 
internal memory on page C5-582 

CDBGDR3 3 UNK 32-bit | Data Register 3, see C5.1 About direct access to 
internal memory on page C5-582. 

CDBGDCT c2 0 UNK 32-bit | Data Cache Tag Read Operation Register, see 
C5.1 About direct access to internal memory 
on page C5-582 

CDBGICT 1 UNK 32-bit | Instruction Cache Tag Read Operation Register, see 
C5.1 About direct access to internal memory 
on page C5-582 

CDBGDCD c4 0 UNK 32-bit | Data Cache Data Read Operation Register, see 
C5.1 About direct access to internal memory 
on page C5-582 

CDBGICD 1 UNK 32-bit | Instruction Cache Data Read Operation Register, see 
C5.1 About direct access to internal memory 
on page C5-582 

CDBGTD 2 UNK 32-bit | TLB Data Read Operation Register, see C5.] About 
direct access to internal memory on page C5-582 

CPUACTLR |- 0 c15 |- Qx80088008890CAGBO | 64-bit | B1.42 CPU Auxiliary Control Register 
on page B1-198 
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B1 AArch32 system registers 


B1.31 AArch32 Implementation defined registers 


Table B1-29 Memory access registers (continued) 

















Name CRn | Op1 | CRm | Op2 | Reset Width | Description 

CPUECTLR |- 1 c15 |- 0x000000OOOOOOOOOO | 64-bit | B/.43 CPU Extended Control Register 
on page B1-202 

CPUMERRSR |- 2 c15 |- - 64-bit | B1.44 CPU Memory Error Syndrome Register 
on page B1-204 

L2MERRSR |- 3 c15 |- - 64-bit | B1.94 L2 Memory Error Syndrome Register 
on page B1-295 
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B1 AArch32 system registers 
B1.32 Auxiliary Control Register 


Auxiliary Control Register 


The ACTLR characteristics are: 


Purpose 
Controls write access to IMPLEMENTATION DEFINED registers in EL2, such as CPUACTLR, 
CPUECTLR, L2CTLR, L2ECTLR, and LZACTLR. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW |RW | RW RW 





























Configurations 
The processor does not implement the ACTLR (NS) register. This register is always RESO. It is 
mapped to AArch64 register ACTLR_EL1. See B2./9 Auxiliary Control Register, ELI 
on page B2-374. 
ACTLR (S) is mapped to AArch64 register ACTLR_EL3. See B2.2/ Auxiliary Control Register, 
EL3 on page B2-377. 


Attributes 
ACTLR is a 32-bit register. 
31 76543 2 1 i 


RESO | | fase) | eso | 


L2ACTLR access cot! | 

L2ECTLR access cot! | 

L2CTLR access control 
CPUECTLR access control 
CPUACTLR access control 


Figure B1-1 ACTLR bit assignments 


[31:7] 
Reserved, RESO. 
L2ACTLR access control, [6] 
L2ACTLR write access control. The possible values are: 


© The register is not write accessible from a lower exception level. This is the reset value. 
1 The register is write accessible from EL2. 

L2ECTLR access control, [5] 
L2ECTLR write access control. The possible values are: 
© The register is not write accessible from a lower exception level. This is the reset value. 
1 The register is write accessible from EL2. 

L2CTLR access control, [4] 
L2CTLR write access control. The possible values are: 
© The register is not write accessible from a lower exception level. This is the reset value. 
1 The register is write accessible from EL2. 

[3:2] 


Reserved, RESO. 
CPUECTLR access control, [1] 
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CPUECTLR write access control. The possible values are: 
© The register is not write accessible from a lower exception level. This is the reset value. 


1 The register is write accessible from EL2. 


CPUACTLR access control, [0] 
CPUACTLR write access control. The possible values are: 


© The register is not write accessible from a lower exception level. This is the reset value. 


1 The register is write accessible from EL2. 


To access the ACTLR: 


MRC p15, @, <Rt>, c1, c@, 1 ; Read ACTLR into Rt 
MCR p15, ©, <Rt>, c1, c0, 1 ; Write Rt to ACTLR 


Register access is encoded as follows: 


Table B1-30 ACTLR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0001 | 0000 | 001 
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B1.33 Auxiliary Data Fault Status Register 
ADFSR 


The processor does not implement ADFSR. This register is always RESo. 
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B1.34 Auxiliary ID Register 
AIDR 


The processor does not implement AIDR. This register is always RESO. 
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B1.35 Auxiliary Instruction Fault Status Register 
AIFSR 


The processor does not implement AIFSR. This register is always RESO. 
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B1.36 Auxiliary Memory Attribute Indirection Register 0 
AMAIRO 


The processor does not implement AMAIRO. This register is always RESO. 
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B1.37 Auxiliary Memory Attribute Indirection Register 1 
AMAIRI 


The processor does not implement AMAIR1. This register is always RESO. 
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B1.38 Configuration Base Address Register 
The CBAR characteristics are: 


Purpose 
Holds the physical base address of the memory-mapped GIC CPU interface registers. 
Usage constraints 
This register is accessible as follows: 



































ELO | ELO)EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO |RO |RO RO 
Configurations 
The CBAR is Common to the Secure and Non-secure states. 
Attributes 
CBAR is a 32-bit register. 
31 1817 8 7 0 


PERIPHBASE[31:18] PERIPHBASE[39:32] 


Figure B1-2 CBAR bit assignments 


PERIPHBASE[31:18], [31:18] 
If the processor is implemented with the GIC CPU interface, the input PERIPHBASE[31:18] 
determines the reset value. If the GIC CPU interface is not implemented, this field is RAZ. 
[17:8] 
Reserved, RESO. 
PERIPHBASE[39:32], [7:0] 
If the processor is implemented with the GIC CPU interface, the input PERIPHBASE[39:32] 
determines the reset value. If the GIC CPU interface is not implemented, this field is RAZ. 


To access the CBAR: 


MRC p15, 1, <Rt>, c15, c3, @; Read CBAR into Rt 
Register access is encoded as follows: 


Table B1-31 CBAR access encoding 





coproc | opc1 | CRn | CRm | opc2 




















1111 001 | 1111 | 0011 | 000 








ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-191 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.39 Cache Size ID Register 


B1.39 Cache Size ID Register 
The CCSIDR characteristics are: 


Purpose 

Provides information about the architecture of the caches. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- [RO |RO ÍRO IRO RO 





























If CSSELR indicates a cache that is not implemented, then on a read of the CCSIDR the 
behavior is CONSTRAINED UNPREDICTABLE, and can be one of the following: 

e The CCSIDR read is treated as NOP. 

e The CCSIDR read is UNDEFINED. 

e The CCSIDR read returns an UNKNOWN value (preferred). 


Configurations 


CCSIDR is architecturally mapped to AArch64 register CCSIDR_EL1. See B2.29 Cache Size 
ID Register, ELI on page B2-386. 


There is one copy of this register that is used in both Secure and Non-secure states. 


The implementation includes one CCSIDR for each cache that it can access. CSSELR selects 
which Cache Size ID Register is accessible. 


Attributes 
CCSIDR is a 32-bit register. 


31 30 29 28 27 13 12 3 2 0 


wT — L_ WA LineSize — 
WB RA 


Figure B1-3 CCSIDR bit assignments 





WT, [31] 
Indicates support for Write-Through: 
(3 Cache level does not support Write-Through. 
WB, [30] 
Indicates support for Write-Back: 
(3 Cache level does not support Write-Back. 
1 Cache level supports Write-Back. 
RA, [29] 
Indicates support for Read-Allocation: 
(3 Cache level does not support Read-Allocation. 
1 Cache level supports Read-Allocation. 
WA, [28] 
Indicates support for Write-Allocation: 
(3 Cache level does not support Write-Allocation. 
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1 Cache level supports Write-Allocation. 


NumSets, [27:13] 
Indicates the number of sets in cache - 1. Therefore, a value of 0 indicates 1 set in the cache. The 
number of sets does not have to be a power of 2. 


For more information about encoding, see Zable B1-32 CCSIDR encodings on page B1-193. 


Associativity, [12:3] 
Indicates the associativity of cache - 1. Therefore, a value of 0 indicates an associativity of 1. 
The associativity does not have to be a power of 2. 


For more information about encoding, see Zable B1-32 CCSIDR encodings on page B1-193. 


LineSize, [2:0] 
Indicates the (logy (number of words in cache line)) - 2: 


b010 16 words per line. 


For more information about encoding, see Zable B1-32 CCSIDR encodings on page B1-193. 


The following table shows the individual bit field and complete register encodings for the CCSIDR. The 
CSSELR determines which CCSIDR to select. 


Table B1-32 CCSIDR encodings 









































































































































CSSELR | Cache Size Complete register Register bit field encoding 
ARERR WT | WB | RA | WA | NumSets | Associativity | LineSize 
0x0 L1 Data cache 8KB 0x7003E01A 0 1 1 1 0x001F 0x003 0x2 
16KB 0x7007E01A 0x003F 0x003 0x2 
32KB 0x700FE01A 0x007F 0x003 0x2 
64KB 0x701FE01A Ox00FF 0x003 0x2 
0x1 L1 Instruction cache | 8KB 0x2007E00A 0 0 1 0 Qx003F 0x001 0x2 
16KB 0x200FE00A 0x007F 0x001 0x2 
32KB 0x201FE00A Q@xOQFF 0x001 0x2 
64KB 0x203FE00A 0x001F 0x001 0x2 
0x2 L2 cache 128KB |0x701FE03A 0 1 1 1 OxOOFF 0x007 0x2 
256KB |0x703FE03A @xO1FF 0x007 0x2 
512KB |0x707FE03A @xO3FF 0x007 0x2 
1024KB | 0x70FFE03A 0x07FF 0x007 0x2 
0x3-0xF | Reserved - - = - è - 4 z = 
To access the CCSIDR: 
MRC p15, 1, <Rt>, c@, c@, @ ; Read CCSIDR into Rt 
Register access is encoded as follows: 
Table B1-33 CCSIDR access encoding 
coproc | opc1 | CRn | CRm | opc2 
1111 001 | 0000 | 0000 | 000 
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Cache Level ID Register 


The CLIDR characteristics are: 
Purpose 
Identifies: 


e The type of cache, or caches, implemented at each level. 
¢ The Level of Coherency and Level of Unification for the cache hierarchy. 


Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO |RO |RO RO 





























Configurations 
CLIDR is architecturally mapped to AArch64 register CLIDR_EL1. See 82.30 Cache Level ID 
Register, ELI on page B2-388. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
CLIDR is a 32-bit register. 


313029 2726 2423 2120 9 


8 6 5 3 2 0 


Figure B1-4 CLIDR bit assignments 


ICB, [31:30] 
Inner cache boundary. This field indicates the boundary between the inner and the outer domain. 


@bee@ Not disclosed in this mechanism. 
LoUU, [29:27] 
Indicates the Level of Unification Uniprocessor for the cache hierarchy: 
@bee1 L1 cache is the last level of cache that must be cleaned or invalidated when cleaning or 
invalidating to the point of unification for the processor. 
LoC, [26:24] 
Indicates the Level of Coherency for the cache hierarchy: 


@bee1 L2 cache not implemented. 


@be1@ A clean to the point of coherency operation requires the L1 and L2 caches to be 
cleaned. 


LoUIS, [23:21] 
Indicates the Level of Unification Inner Shareable for the cache hierarchy: 


@bee1 L2 cache not implemented or BROADCASTINNER set to 0. 


The L1 cache is the last level of cache that must be cleaned or invalidated when 
cleaning or invalidating to the point of unification for the Inner Shareable shareability 
domain. 
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B1 AArch32 system registers 


The L2 cache is the last level of cache that must be cleaned or invalidated when 
cleaning or invalidating to the point of unification for the Inner Shareable shareability 


domain. 


[20:9] 
Reserved, RESO. 
Ctype3, [8:6] 
Indicates the type of cache if the processor implements L3 cache: 


@beee L3 cache not implemented. 


B1.40 Cache Level ID Register 


If software reads the Cache Type fields from Ctypel upwards, after it has seen a value of @bee0, 


no caches exist at further-out levels of the hierarchy. So, for example, if Ctype2 is the first 
Cache Type field with a value of @b@0@, the value of Ctype3 must be ignored. 


Ctype2, [5:3] 
Indicates the type of cache if the processor implements L2 cache: 


@beee L2 cache is not implemented. 


@b10@ L2 cache is implemented as a unified cache. 


Ctypel, [2:0] 
Indicates the type of cache implemented at L1: 


@b@11 Separate instruction and data caches at L1. 


To access the CLIDR: 


MRC p15,1,<Rt>,c@,c@,1 ; Read CLIDR into Rt 


Register access is encoded as follows: 


Table B1-34 CLIDR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 001 0000 | 0000 | 001 
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B1.41 Architectural Feature Access Control Register 
The CPACR characteristics are: 


Purpose 

Controls access to CPO to CP13, and indicates which of CPO to CP13 are implemented. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























The CPACR has no effect on instructions executed at EL2. 


Configurations 
CPACR is architecturally mapped to AArch64 register CPACR_EL1. See B2.3/ Architectural 
Feature Access Control Register, ELI on page B2-390. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Bits in the NSACR control Non-secure access to the CPACR fields. See the field descriptions 
cp10 and cp11. 


Attributes 
CPACR is a 32-bit register. 
31 30 24:23 22 21 20 19 0 
dos eeo e 
L—ASEDIS 


Figure B1-5 CPACR bit assignments 
ASEDIS, [31] 
Disable Advanced SIMD functionality: 
© Does not cause any instructions to be UNDEFINED. This is the reset value. 


1 All instruction encodings that are part of Advanced SIMD, but that are not floating-point 
instructions, are UNDEFINED. 


If Advanced SIMD and floating-point are not implemented, this bit is REso. 


[30:24] 
Reserved, RESO. 

cp11, [23:22] 
Defines the access rights for CP11, that control the Advanced SIMD and floating-point features. 
Possible values of the fields are: 


@bee@ Access denied. Any attempt to access Advanced SIMD and floating-point registers or 
instructions generates an Undefined Instruction exception. This is the reset value. 


@be1 Access at EL1 only. Any attempt to access Advanced SIMD and floating-point registers 
or instructions from software executing at ELO generates an Undefined Instruction 
exception. 


@b10 Reserved. 
@b11 Full access. 


If Advanced SIMD and floating-point are not implemented, this field is REso. 
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The Advanced SIMD and floating-point features controlled by these fields are: 


Floating-point instructions. 
Advanced SIMD instructions, both integer and floating-point. 


Advanced SIMD and floating-point registers DO-D31 and their views as SO-S31 and QO- 


Q15. 


FPSCR, FPSID, MVFRO, MVFR1, MVFR2, FPEXC system registers. 


If the cp11 and cp10 fields are set to different values, the behavior is the same as if both fields 
were set to the value of cp10, in all respects other than the value read back by explicitly reading 
cpll. 


cp10, [21:20] 


Defines the access rights for CP10, that control the Advanced SIMD and floating-point features. 
Possible values of the fields are: 


e@bee 


@be1 


instructions generates an Undefined Instruction exception. This is the reset value. 


or instructions from software executing at ELO generates an Undefined Instruction 


exception. 


@b10 Reserved. 
@b11 Full access. 


If Advanced SIMD and floating-point are not implemented, this bit is REso. 


The Advanced SIMD and floating-point features controlled by these fields are: 


Floating-point instructions. 
Advanced SIMD instructions, both integer and floating-point. 


Access denied. Any attempt to access Advanced SIMD and floating-point registers or 


Access at EL1 only. Any attempt to access Advanced SIMD and floating-point registers 


Advanced SIMD and floating-point registers DO-D31 and their views as SO-S31 and QO- 


Q15. 
e FPSCR, FPSID, MVFRO, MVFR1, MVFR2, FPEXC system registers. 
[19:0] 
Reserved, RESO. 
To access the CPACR: 


MRC p15,0,<Rt>,c1,c@,2 ; Read CPACR into Rt 
MCR p15,0,<Rt>,c1,c@,2 ; Write Rt to CPACR 


Register access is encoded as follows: 


Table B1-35 CPACR access encoding 





coproc 


opc1 


CRn | CRm 


opc2 





1111 








000 





0001 | 0000 





010 
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B1.42 CPU Auxiliary Control Register 
The CPUACTLR characteristics are: 


Purpose 
Provides IMPLEMENTATION DEFINED configuration and control options for the processor. There is 
one 64-bit CPU Auxiliary Control Register for each core in the processor. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW |RW | RW RW 





























The CPU Auxiliary Control Register can be written only when the system is idle. ARM 
recommends that you write to this register after a powerup reset, before the MMU is enabled, 
and before any master interface or ACP traffic begins. 


Setting many of these bits can cause significantly lower performance on your code. Therefore, it 
is suggested that you do not modify this register unless directed by ARM. 


Configurations 
CPUACTLR is: 


e Common to the Secure and Non-secure states. 
e Mapped to the AArch64 CPUACTLR_ ELI register. See B2.36 CPU Auxiliary Control 
Register, ELI on page B2-400. 


Attributes 
CPUACTLR is a 64-bit register. 


45 44 43 31 30 29 28 27 26 25 24 23 22 21 201918171615 13121110 9 7 65 


ENDCCASCI— CDIDIS— | Loe | Lorn 
DIDIS = | Lovens L1DEIEN 
RADIS DSTDIS RESO 
L1RADIS NPFSTRM 





DTAH 
STBPFRS 


RESO 
STBPFDIS 


Figure B1-6 CPUACTLR bit assignments 


[63:45] 
Reserved, RESO. 
ENDCCASCT, [44] 
Enable data cache clean as data cache clean/invalidate. The possible values are: 


(3 Normal behavior, data cache clean operations are unaffected. This is the reset 
value. 
1 Executes data cache clean operations as data cache clean and invalidate. The 


following operations are affected: 

¢« In AArch32, DCCSW is executed as DCCISW, DCCMVAU and DCCMVAC 
are executed as DCCIMVAC. 

¢ In AArch64, DC CSW is executed as DC CISW, DC CVAU and DC CVAC are 
executed as DC CIVAC. 
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[43:31] 
Reserved, RESO. 
CDIDIS, [30] 
Disable Cryptographic dual issue. The possible values are: 


) Enable dual issue of Advanced SIMD and Cryptographic instructions. This is the 
reset value. 


1 Disable dual issue of Advanced SIMD and Cryptographic instructions. 
DIDIS, [29] 

Disable Dual Issue. The possible values are: 

(3 Enable Dual Issue of instructions. This is the reset value. 

1 Disable Dual Issue of all instructions. 


RADIS, [28:27] 
Write streaming no-allocate threshold. The possible values are: 


e@bee 16th consecutive streaming cache line does not allocate in the L1 or L2 cache. 

@be1 128th consecutive streaming cache line does not allocate in the L1 or L2 cache. 
This is the reset value. 

@b10 512th consecutive streaming cache line does not allocate in the L1 or L2 cache. 

@b11 Disables streaming. All write-allocate lines allocate in the L1 or L2 cache. 


LIRADIS, [26:25] 
Write streaming no-L1-allocate threshold. The possible values are: 


e@bee 4th consecutive streaming cache line does not allocate in the L1 cache. This is the 
reset value. 
@be1 64th consecutive streaming cache line does not allocate in the L1 cache. 
@b10 128th consecutive streaming cache line does not allocate in the L1 cache. 
@b11 Disables streaming. All write-allocate lines allocate in the L1 cache. 
DTAH, [24] 
Disable transient and no-read-allocate hints for loads. The possible values are: 
(3 Normal operation. 
1 Transient and no-read-allocate hints in the MAIR are ignored and treated the same 


as non-transient, read-allocate types for loads. 


The LDNP instruction in AArch64 behaves the same as the equivalent LDP 
instruction. This is the reset value. 


STBPFRS, [23] 
Disable ReadUnique request for prefetch streams initiated by STB accesses: 


(3 ReadUnique used for prefetch streams initiated from STB accesses. This is the 
reset value. 

1 ReadShared used for prefetch streams initiated from STB accesses. 
STBPFDIS, [22] 

Disable prefetch streams initiated from STB accesses: 

@ Enable Prefetch streams initiated from STB accesses. This is the reset value. 

1 Disable Prefetch streams initiated from STB accesses. 
[21] 

Reserved, RESO. 


NPFSTRM, [20:19] 
Number of independent data prefetch streams. The possible values are: 
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@bee 1 stream. 

@be1 2 streams. This is the reset value. 
@b10 3 streams. 

@b11 4 streams. 


DSTDIS, [18] 
Enable device split throttle. The possible values are: 
(3 Device split throttle disabled. 
1 Device split throttle enabled. This is the reset value. 


STRIDE, [17] 
Enable stride detection. The possible values are: 
(3 2 consecutive strides to trigger prefetch. This is the reset value. 


1 3 consecutive strides to trigger prefetch. 


[16] 
Reserved, RESO. 

LIPCTL, [15:13] 
L1 Data prefetch control. The value of the this field determines the maximum number of 
outstanding data prefetches allowed in the L1 memory system, excluding those generated by 
software load or PLD instructions. The possible values are: 


e@beee Prefetch disabled. 

@bee1 1 outstanding prefetch allowed. 

@be10 2 outstanding prefetches allowed. 

@be11 3 outstanding prefetches allowed. 

0b100 4 outstanding prefetches allowed. 

0b101 5 outstanding prefetches allowed. This is the reset value. 
b110 6 outstanding prefetches allowed. 

@b111 8 outstanding prefetches allowed. 


[12] 
Reserved, RESO. 

DYNSDIS, [11] 
Disable dynamic stride adjustment for prefetch streams. The possible values are: 
0 Enable dynamic stride adjustment. This is the reset value. 


1 Disable dynamic stride adjustment. 
DODMBS, [10] 
Disable optimized Data Memory Barrier behavior. The possible values are: 
@ Enable optimized Data Memory Barrier behavior. This is the reset value. 
1 Disable optimized Data Memory Barrier behavior. 
[9:7] 
Reserved, RESO. 


L1DEIEN, [6] 
L1 D-cache data RAM error injection enable. The possible values are; 





(3 Normal behavior, errors are not injected. This is the reset value. 
1 Double-bit errors are injected on all writes to the L1 D-cache data RAMs for the 
first word of each 32-byte region. 
[5:0] 
Reserved, RESO. 
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To access the CPUACTLR: 


MRRC p15, ©, <Rt>, <Rt2>, c15; Read CPU Auxiliary Control Register 
MCRR p15, ©, <Rt>, <Rt2>, c15; Write CPU Auxiliary Control Register 


Register access is encoded as follows: 


Table B1-36 CPUACTLR access encoding 





coproc | opc1 | CRm 





1111 0000 | 1111 
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B1.43 CPU Extended Control Register 
The CPUECTLR characteristics are: 


Purpose 

Provides additional IMPLEMENTATION DEFINED configuration and control options for the processor. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























The CPUECTLR can be written dynamically. 


Configurations 
The CPUECTLR is mapped to the AArch64 CPUECTLR_ELI register. See 82.37 CPU 
Extended Control Register, EL] on page B2-404. 


Attributes 
CPUECTLR is a 64-bit register. 
63 765 3 2 0 
RESO 
SMPEN— 
FPRETCTL 
CPURETCTL 
Figure B1-7 CPUECTLR bit assignments 
[63:7] 
Reserved, RESO. 
SMPEN, [6] 
Enable hardware management of data coherency with other cores in the cluster. The possible 
values are: 


@ Disables data coherency with other cores in the cluster. This is the reset value. 
1 Enables data coherency with other cores in the cluster. 


Set the SMPEN bit before enabling the caches, even if there is only one core in the system. 


FPRETCTL, [5:3] 
Advanced SIMD and floating-point retention control. The possible values are: 
@beee Disable the retention circuit. This is the reset value. 
@bee1 2 Architectural Timer ticks are required before retention entry. 
@be1e@ 8 Architectural Timer ticks are required before retention entry. 
@b@11 32 Architectural Timer ticks are required before retention entry. 
@b10e 64 Architectural Timer ticks are required before retention entry. 
@b101 128 Architectural Timer ticks are required before retention entry. 
@b11@ 256 Architectural Timer ticks are required before retention entry. 
@b111 512 Architectural Timer ticks are required before retention entry. 


This field is present only if the Advanced SIMD and floating-point support is implemented. 
Otherwise, it is RESO. 


CPURETCTL, [2:0] 
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B1 AArch32 system registers 
B1.43 CPU Extended Control Register 


CPU retention control. The possible values are: 


@beee Disable the retention circuit. This is the reset value. 
@bee1 2 Architectural Timer ticks are required before retention entry. 
@be1e@ 8 Architectural Timer ticks are required before retention entry. 
@be11 32 Architectural Timer ticks are required before retention entry. 
b100 64 Architectural Timer ticks are required before retention entry. 
@b101 128 Architectural Timer ticks are required before retention entry. 
@b11@ 256 Architectural Timer ticks are required before retention entry. 
@b111 512 Architectural Timer ticks are required before retention entry. 
To access the CPUECTLR: 


MRRC p15, 1, <Rt>, <Rt2>, c15; Read CPU Extended Control Register 
MCRR p15, 1, <Rt>, <Rt2>, c15; Write CPU Extended Control Register 


Register access is encoded as follows: 


Table B1-37 CPUECTLR access encoding 





coproc | opc1 | CRm 





1111 0001 |1111 
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B1 AArch32 system registers 
B1.44 CPU Memory Error Syndrome Register 


B1.44 CPU Memory Error Syndrome Register 
The CPUMERRSR characteristics are: 


Purpose 
Holds ECC errors on the: 
e LI data RAMs. 
e LI tag RAMs. 
¢ TLB RAMs. 


This register is used for recording ECC errors on all processor RAMs. 


Usage constraints 
This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |. [Rw {Rw IRW [RW RW 





























Configurations 
CPUMERRSR is mapped to the AArch64 CPUMERRSR_EL] register. See B2.38 CPU 
Memory Error Syndrome Register, ELI on page B2-406. 


There is one copy of this register that is used in both Secure and Non-secure states. 


A write of any value to the register updates the register to e280008000000000. 





Attributes 
CPUMERRSR is a 64-bit register. 
63 62 48 47 40 39 32 31 30 24 23 21 201817 1211 0 
| RESO Ohereror || Repeateror RAMID | RESO RESO RAM address 
count count 
L Fatal Valid CPUID/Way 


Figure B1-8 CPUMERRSR bit assignments 


Fatal, [63] 
Fatal bit. This bit is set to 1 on the first memory error that caused a data abort. It is a sticky bit 
so that after it is set, it remains set until the register is written. 


The reset value is 0. 


[62:48] 
Reserved, RESO. 

Other error count, [47:40] 
This field is set to 0 on the first memory error and is incremented on any memory error that does 
not match the RAMID and Bank/Way information in this register while the sticky Valid bit is 
set. 


The reset value is 0. 


Repeat error count, [39:32] 
This field is set to 0 on the first memory error and is incremented on any memory error that 
exactly matches the RAMID and Bank/Way information in this register while the sticky Valid 
bit is set. 


The reset value is 0. 
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Valid, [31] 
Valid bit. This bit is set to 1 on the first memory error. It is a sticky bit so that after it is set, it 
remains set until the register is written. 


RAMID, [30:24] 


[23:21] 


B1 AArch32 system registers 


B1.44 CPU Memory Error Syndrome Register 


The reset value is 0. 


RAM Identifier. Indicates the RAM in which the first memory error. The possible values are: 


exee@ L1 Instruction tag RAM. 
@xe1 L1 Instruction data RAM. 
exes L1 Data tag RAM. 

exe9 L1 Data data RAM. 

ƏxðA LI Data dirty RAM. 

0x18 TLB RAM. 


Reserved, RESO. 


CPUID/Way, [20:18] 
Indicates the RAM where the first memory error occurred. 


L1 I-tag RAM 
@x® Way 0 
@x1 Way 1 
@x2-Ox7 Unused 
L1 I-data RAM 
@x® Bank 0 
@x1 Bank 1 
@x2-Ox7 Unused 
TLB RAM 
@x® Way 0 
@x1 Way 1 
@x2-Ox7 Unused 
L1 D-dirty RAM 
exe Dirty RAM 
@x1-0x7 Unused 
L1 D-tag RAM 
@x® Way 0 
@x1 Way 1 
0x2 Way 2 
0x3 Way 3 
0x4-0x7 Unused 
L1 D-data RAM 
@x® Way0-Bank0 
@x1 Way0-Bank1 
0x2 Way |-Bank0O 
0x3 Wayl-Bank1 
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B1 AArch32 system registers 
B1.44 CPU Memory Error Syndrome Register 


0x7 Way3-Bank1 


[17:12] 
Reserved, RESO. 
RAM address, [11:0] 
Indicates the index address of the first memory error. 


e A fatal error results in the RAMID, Way, and RAM address recording the fatal error, even if the 
sticky bit is set. 

e Only LI Data data and L1 Data dirty RAMs can signal fatal errors, because all other RAM instances 
are protected only by parity. 

¢ Iftwo or more memory errors in the same RAM occur in the same cycle, only one error is reported. 

¢ Iftwo or more first memory error events from different RAMs occur in the same cycle, one of the 
errors is selected arbitrarily. 

e Iftwo or more memory error events from different RAMs, that do not match the RAMID, Way, and 
index information in this register while the sticky Valid bit is set, occur in the same cycle, then the 
Other error count field is incremented only by one. 


To access the CPUMERRSR: 


MRRC p15, 2, <Rt>, <Rt2>, c15; Read CPUMERRSR into Rt and Rt2 
MCRR p15, 2, <Rt>, <Rt2>, c15; Write Rt and Rt2 to CPUMERRSR 


Register access is encoded as follows: 


Table B1-38 CPUMERRSR access encoding 





coproc | opc1 | CRm 





1111 0010 | 1111 
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B1 AArch32 system registers 
B1.45 Cache Size Selection Register 


B1.45 Cache Size Selection Register 
The CSSELR characteristics are: 


Purpose 
Selects the current CCSIDR, see B/.39 Cache Size ID Register on page B1-192, by specifying: 
e The required cache level. 
e The cache type, either instruction or data cache. 


Usage constraints 
This register is accessible as follows: 








ELO | ELO|EL1 |EL1/EL2/EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























If the CSSELR level field is programmed to a cache level that is not implemented, then a read of 
CSSELR returns an UNKNOWN value in CSSELR. Level. 


Configurations 
CSSELR (NS) is architecturally mapped to AArch64 register CSSELR_EL1. See B2.34 Cache 
Size Selection Register, ELI on page B2-396. 
If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 
Attributes 
CSSELR is a 32-bit register. 


31 4 3 1 0 


UNK/SBZP tevet | 


inp! 


Figure B1-9 CSSELR bit assignments 


[31:4] 
Reserved, RESO. 
Level, [3:1] 
Cache level of required cache: 


Q@beee Ll. 
Q@be0e1 L2. 
@bQ10-@b111 Reserved. 


The combination of Level=@be01 and InD=1 is reserved. 


InD, [0] 
Instruction not Data bit: 


@ Data or unified cache. 

1 Instruction cache. 

The combination of Level=@be01 and InD=1 is reserved. 
To access the CSSELR: 


MRC p15, 2, <Rt>, c@, c@, @; Read CSSELR into Rt 
MCR p15, 2, <Rt>, c@, c0, @; Write Rt to CSSELR 


Register access is encoded as follows: 
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B1 AArch32 system registers 
B1.45 Cache Size Selection Register 


Table B1-39 CSSELR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 010 | 0000 | 0001 | 000 
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B1 AArch32 system registers 
B1.46 Cache Type Register 


B1.46 Cache Type Register 
The CTR characteristics are: 


Purpose 

Provides information about the architecture of the caches. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- [RO |RO ÍRO IRO RO 





























Configurations 
CTR is architecturally mapped to AArch64 register CTR_ELO. See B2.35 Cache Type Register, 
ELO on page B2-398. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
CTR is a 32-bit register. 
3130 2827 24 23 20 19 16 15 14 13 4 3 0 
SS e e 
LrRes1 
Figure B1-10 CTR bit assignments 
[31] 


Reserved, RESI. 

[30:28] 
Reserved, RESO. 

CWG, [27:24] 
Cache Write-Back granule. Log, of the number of words of the maximum size of memory that 
can be overwritten as a result of the eviction of a cache entry that has had a memory location in 
it modified: 


0x4 Cache Write-Back granule size is 16 words. 
ERG, [23:20] 
Exclusives Reservation Granule. Log, of the number of words of the maximum size of the 


reservation granule that has been implemented for the Load-Exclusive and Store-Exclusive 
instructions: 


0x4 Exclusive reservation granule size is 16 words. 
DminLine, [19:16] 


Log» of the number of words in the smallest cache line of all the data and unified caches that the 
processor controls: 


0x4 Smallest data cache line size is 16 words. 
L1lp, [15:14] 


L1 Instruction cache policy. Indicates the indexing and tagging policy for the L1 Instruction 
cache: 


b10 Virtually Indexed Physically Tagged (VIPT). 


[13:4] 
Reserved, RESO. 
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IminLine, [3:0] 


B1 AArch32 system registers 
B1.46 Cache Type Register 


Log, of the number of words in the smallest cache line of all the instruction caches that the 


processor controls. 


0x4 Smallest instruction cache line size is 16 words. 
To access the CTR: 
MRC p15,0,<Rt>,c@,c@,1 ; Read CTR into Rt 


Register access is encoded as follows: 


Table B1-40 CTR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 010 |0000 |0000 |001 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-210 


reserved. 
Non-Confidential 


B1.47 Domain Access Control Register 
The DACR characteristics are: 


Purpose 


B1 AArch32 system registers 
B1.47 Domain Access Control Register 


Defines the access permission for each of the sixteen memory domains. 


Usage constraints 
This register is accessible as follows: 


























ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- [RW {Rw IRW [RW RW 











Configurations 


DACR (NS) is architecturally mapped to AArch64 register DACR32_EL2. See B2.39 Domain 


Access Control Register, EL2 on page B2-409. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


DACR has no function when TTBCR.EAE is set to 1, to select the Long-descriptor translation 


table format. 


Attributes 
DACR is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16:15 14 13 1211109 8 76543210 





Figure B1-11 DACR bit assignments 


D<n>, bits [2n+1:2n], for n = 0 to 15, [31:0] 


Domain n access permission, where n = 0 to 15. Permitted values are: 


@bee No access. Any access to the domain generates a Domain fault. 


b01 Client. Accesses are checked against the permission bits in the translation tables. 


@b11 Manager. Accesses are not checked against the permission bits in the translation tables. 


The value 0b19 is reserved. 
To access the DACR: 


MRC p15, @, <Rt>, c3, c@, @ ; Read DACR into Rt 
MCR p15, ©, <Rt>, c3, c0, © ; Write Rt to DACR 


Register access is encoded as follows: 


Table B1-41 DACR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0011 | 0000 | 000 
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B1 AArch32 system registers 
B1.48 Data Fault Address Register 


Data Fault Address Register 


The DFAR characteristics are: 


Purpose 
Holds the virtual address of the faulting address that caused a synchronous Data Abort 
exception. 

Usage constraints 
This register is accessible as follows: 











ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 

(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
DFAR(S) |- a g RW |- l- RW 
DFAR(NS) | - - RW |- RW | RW - 
































Configurations 
DFAR (NS) is architecturally mapped to AArch64 register FAR_EL1[31:0]. See 82.44 Fault 
Address Register, EL] on page B2-417. 


DFAR (S) is architecturally mapped to AArch32 register HDFAR. See B/.64 Hyp Data Fault 
Address Register on page B1-241. 


DFAR (S) is architecturally mapped to AArch64 register FAR _EL2[31:0]. See B2.45 Fault 
Address Register, EL2 on page B2-418. 


Attributes 
DFAR is a 32-bit register. 
31 0 
Figure B1-12 DFAR bit assignments 
VA, [31:0] 


The Virtual Address of faulting address of synchronous Data Abort exception. 
To access the DFAR: 


MRC p15, @, <Rt>, c6, c@, @ ; Read DFAR into Rt 
MCR p15, ©, <Rt>, c6, c0, © ; Write Rt to DFAR 


Register access is encoded as follows: 


Table B1-42 DFAR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0110 | 0000 | 000 
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B1 AArch32 system registers 
B1.49 Data Fault Status Register 


B1.49 Data Fault Status Register 
The DFSR characteristics are: 


Purpose 

Holds status information about the last data fault. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























Configurations 
DFSR (NS) is architecturally mapped to AArch64 register ESR_EL1. See B2.4/ Exception 
Syndrome Register, ELI on page B2-411 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


There are two formats for this register. The current translation table format determines which 
format of the register is used. 


Attributes 
DFSR is a 32-bit register. 
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B1 AArch32 system registers 
B1.50 DFSR with Short-descriptor translation table format 


B1.50 DFSR with Short-descriptor translation table format 
DFSR has a specific format when using the Short-descriptor translation table format. 


The following figure shows the DFSR bit assignments when using the Short-descriptor translation table 


format. 
31 14131211109 8 7 4 3 0 
L- RESO 
FS[4] 
WnR 
ExT 
CM 
Figure B1-13 DFSR bit assignments for Short-descriptor translation table format 
[31:14] 
Reserved, RESO. 
CM, [13] 


Cache maintenance fault. For synchronous faults, this bit indicates whether a cache maintenance 
operation generated the fault: 


(3 Abort not caused by a cache maintenance operation. 
1 Abort caused by a cache maintenance operation. 
ExT, [12] 
External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 
(3 External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 


WnR, [11] 
Write not Read bit. This field indicates whether the abort was caused by a write or a read access: 
(3 Abort caused by a read access. 


1 Abort caused by a write access. 


For faults on CP15 cache maintenance operations, including the VA to PA translation 
operations, this bit always returns a value of 1. 


FS[4], [10] 
Part of the Fault Status field. See bits [3:0] in this table. 
[9] 
RAZ. 
[8] 
Reserved, RESO. 
Domain, [7:4] 
Specifies which of the 16 domains, D15-D0, was being accessed when a data fault occurred. 


For permission faults that generate Data Abort exception, this field is unknown. ARMv8 
deprecates any use of the domain field in the DFSR. 


FS[3:0], [3:0] 
Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is 
reserved: 


@bee0ee1 Alignment fault. 
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B1 AArch32 system registers 
B1.50 DFSR with Short-descriptor translation table format 





@beee10 Debug event. 

@beee11 Access flag fault, section. 

@bee10e Instruction cache maintenance fault. 

@bee101 Translation fault, section. 

@bee11@ Access flag fault, page. 

@be0111 Translation fault, page. 

@be10ee@ Synchronous external abort, non-translation. 

@be1001 Domain fault, section. 

@b@1011 Domain fault, page. 

@be110@ Synchronous external abort on translation table walk, first level. 

@be1101 Permission fault, section. 

@b@111@ Synchronous external abort on translation table walk, second level. 

@b@1111 Permission fault, second level. 

0b10009 TLB conflict abort. 

@b10101 LDREX or STREX abort. 

@b1011@ Asynchronous external abort. 

@b1100@ Asynchronous parity error on memory access. 

@b11001 Synchronous parity error on memory access. 

@b1110@ Synchronous parity error on translation table walk, first level. 

@b1111@ Synchronous parity error on translation table walk, second level. 
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B1 AArch32 system registers 
B1.51 DFSR with Long-descriptor translation table format 


B1.51 DFSR with Long-descriptor translation table format 
DFSR has a specific format when using the Long-descriptor translation table format. 


The following figure shows the DFSR bit assignments when using the Long-descriptor translation table 


format. 
31 1413121110 9 8 6 5 0 
L— RESO 
WnR 
ExT 
CM 
Figure B1-14 DFSR bit assignments for Long-descriptor translation table format 
[31:14] 
Reserved, RESO. 
CM, [13] 


Cache maintenance fault. For synchronous faults, this bit indicates whether a cache maintenance 
operation generated the fault: 


(3 Abort not caused by a cache maintenance operation. 
1 Abort caused by a cache maintenance operation. 
ExT, [12] 
External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 
(3 External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 


WnR, [11] 
Write not Read bit. This field indicates whether the abort was caused by a write or a read access: 
(3 Abort caused by a read access. 


1 Abort caused by a write access. 


For faults on CP15 cache maintenance operations, including the VA to PA translation 
operations, this bit always returns a value of 1. 


[10] 
Reserved, RESO. 

[9] 
RAO. 

[8:6] 
Reserved, RESO. 

Status, [5:0] 
Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is 
reserved. 
@beeeeee Address size fault in TTBRO or TTBRI. 
@b@G01LL Translation fault, LL bits indicate level. 
@b@@10LL Access fault flag, LL bits indicate level. 
@b@011LL Permission fault, LL bits indicate level. 
@be1eeee Synchronous external abort. 
@b@10001 Asynchronous external abort. 
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B1 AArch32 system registers 
B1.51 DFSR with Long-descriptor translation table format 
@b@101LL Synchronous external abort on translation table walk, LL bits indicate level. 
@b@110e@ Synchronous parity error on memory access. 
@b@11001 Asynchronous parity error on memory access (DFSR only). 


@b@111LL Synchronous parity error on memory access on translation table walk, first level, LL 
bits indicate level. 


0b100001 Alignment fault. 
@b100018 Debug event. 
0b1100090 TLB conflict abort. 
@b110101 LDREX or STREX abort. 


Table B1-43 Encodings of LL bits associated with the MMU fault 





Bits | Meaning 





@beO | Reserved 





Qb@1 | Level 1 





@b10 | Level 2 





0b11 | Level 3 














To access the DFSR: 


MRC p15, @, <Rt>, c5, c@, @; Read DFSR into Rt 
MCR p15, ©, <Rt>, c5, c0, @; Write Rt to DFSR 
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B1 AArch32 system registers 
B1.52 Encoding of ISS[24:20] when HSR[31:30] is Ob00 


B1.52 Encoding of ISS[24:20] when HSR[31:30] is 0b00 


For EC values that are nonzero and have the two most-significant bits 0b00, ISS[24:20] provides the 
condition field for the trapped instruction, together with a valid flag for this field. 


The encoding of this part of the ISS field is: 


CV, ISS[24] 
Condition valid. Possible values of this bit are: 
(7) The COND field is not valid. 
1 The COND field is valid. 


When an instruction is trapped, CV is set to 1. 


COND, ISS[23:20] 
The Condition field for the trapped instruction. This field is valid only when CV is set to 1. 


If CV is set to 0, this field is RESO. 


When an instruction is trapped, the COND field is set to the condition the instruction was executed with. 





ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-218 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.53 FCSE Process ID Register 


B1.53  FCSE Process ID Register 
FCSEIDR 


The processor does not implement Fast Context Switch Extension (FCSE). This register is always RESo. 
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B1 AArch32 system registers 
B1.54 Hyp Auxiliary Configuration Register 


B1.54 Hyp Auxiliary Configuration Register 
HACR 


The processor does not implement HACR. This register is always RESO. 
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B1 AArch32 system registers 
B1.55 Hyp Auxiliary Control Register 


B1.55 Hyp Auxiliary Control Register 
The HACTLR characteristics are: 


Purpose 
Controls write access to IMPLEMENTATION DEFINED registers in Non-secure EL1 modes, such as 
CPUACTLR, CPUECTLR, L2CTLR, L2ECTLR, and L2ZACTLR. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - - RW | RW 





























Configurations 
The HACTLR is architecturally mapped to the AArch64 ACTLR_EL2 register. See 
B2.20 Auxiliary Control Register, EL2 on page B2-375. 

Attributes 
HACTLR is a 32-bit register. 


L2ACTLR access control a 
L2ECTLR access control 


L2CTLR access control 
CPUECTLR access control 
CPUACTLR access control 


Figure B1-15 HACTLR bit assignments 


[31:7] 
Reserved, RESO. 
L2ACTLR access control, [6] 
L2ACTLR write access control. The possible values are: 


© The register is not write accessible from Non-secure EL1. 
This is the reset value. 
1 The register is write accessible from Non-secure EL1. 
Write access from Non-secure EL1 also requires ACTLR(S)[6] to be set. 
L2ECTLR access control, [5] 
L2ECTLR write access control. The possible values are: 
© The register is not write accessible from Non-secure EL1. 
This is the reset value. 
1 The register is write accessible from Non-secure EL1. 
Write access from Non-secure EL1 also requires ACTLR(S)[5] to be set. 
L2CTLR access control, [4] 
L2CTLR write access control. The possible values are: 
© The register is not write accessible from Non-secure EL1. 


This is the reset value. 





ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-221 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.55 Hyp Auxiliary Control Register 


1 The register is write accessible from Non-secure EL1. 
Write access from Non-secure EL1 also requires ACTLR(S)[4] to be set. 
[3:2] 
Reserved, RESO. 


CPUECTLR access control, [1] 
CPUECTLR write access control. The possible values are: 


© The register is not write accessible from Non-secure EL1. 
This is the reset value. 
1 The register is write accessible from Non-secure EL1. 


Write access from Non-secure EL1 also requires ACTLR(S)[1] to be set. 


CPUACTLR access control, [0] 
CPUACTLR write access control. The possible values are: 


© The register is not write accessible from Non-secure EL1. 
This is the reset value. 
1 The register is write accessible from Non-secure EL1. 


Write access from Non-secure EL1 also requires ACTLR(S)[0] to be set. 


To access the HACTLR: 


MRC p15,4,<Rt>,c1,c@,1 ; Read HACTLR into Rt 
MCR p15,4,<Rt>,c1,c@,1 ; Write Rt to HACTLR 


Register access is encoded as follows: 


Table B1-44 HACTLR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 100 | 0001 |0000 | 001 
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B1.56 Hyp Auxiliary Data Fault Status Syndrome Register 
HADFSR 


The processor does not implement HADFSR. This register is always RESO. 
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B1.57 Hyp Auxiliary Instruction Fault Status Syndrome Register 
HAIFSR 


The processor does not implement HAIFSR. This register is always RESO. 
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B1.58 Hyp Auxiliary Memory Attribute Indirection Register 0 
HAMAIRO 


The processor does not implement HAMAIRO. This register is always RESO. 
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B1.59 Hyp Auxiliary Memory Attribute Indirection Register 1 
HAMAIRI 


The processor does not implement HAMAIRI. This register is always RESO. 
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B1.60 Hyp Architectural Feature Trap Register 
The HCPTR characteristics are: 


Purpose 
Controls trapping to Hyp mode of Non-secure access, at EL1 or lower, to coprocessors other 
than CP14 and CP15 and to floating-point and Advanced SIMD functionality. Also controls 
access from Hyp mode to this functionality. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |. |. |- [Rw [RW s 





























If a bit in the NSACR prohibits a Non-secure access, then the corresponding bit in the HCPTR 
behaves as RAO/WI for Non-secure accesses. See the bit description for TASE. 


Configurations 
HCPTR is architecturally mapped to AArch64 register CPTR_EL2. See 82.32 Architectural 
Feature Trap Register, EL2 on page B2-392. 

Attributes 
HCPTR is a 32-bit register. 


31 30 21 2019 161514131211109 876543210 


j RESO i RESO ii RES1 ll RES1 


L_TCPAC TTA — TASE —! | L_TCP10 
RESO TCP11 





Figure B1-16 HCPTR bit assignments 
TCPAC, [31] 
Trap CPACR accesses. The possible values of this bit are: 


@ Has no effect on CPACR accesses. 
1 Trap valid Non-secure EL1 CPACR accesses to Hyp mode. 


When this bit is set to 1, any valid Non-secure EL1 access to the CPACR is trapped to Hyp 
mode. 


Resets to 0. 


[30:21] 

Reserved, RESO. 
TTA, [20] 

Trap Trace Access. 


Not implemented. REso. 


[19:16] 
Reserved, RESO. 
TASE, [15] 
Trap Advanced SIMD use: 





ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-227 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.60 Hyp Architectural Feature Trap Register 


© If the NSACR settings permit Non-secure use of the Advanced SIMD functionality then Hyp 
mode can access that functionality, regardless of any settings in the CPACR. This bit value 
has no effect on possible use of the Advanced SIMD functionality from Non-secure EL1 and 
ELO modes. 


Trap valid Non-secure accesses to Advanced SIMD functionality to Hyp mode. 


e 


If Advanced SIMD and floating-point are not implemented, this bit is RAO/WI. 


If NSACR.NSASEDIS is set to 1, then on Non-secure accesses to the HCPTR, the TASE bit 
behaves as RAO/WI. 


[14] 
Reserved, RESO. 
[13:12] 
Reserved, RESI. 
TCP11, [11] 
Trap CP11. The possible values of each of this bit is: 


© If NSACR.cp11 is set to 1, then Hyp mode can access CP11, regardless of the value of 


CPACR.cp11. This bit value has no effect on possible use of CP11 from Non-secure EL1 and 
ELO modes. 
1 Trap valid Non-secure accesses to CP11 to Hyp mode. 
Any otherwise-valid access to CP11 from: 
e A Non-secure EL1 or ELO state is trapped to Hyp mode. 
e Hyp mode generates an Undefined Instruction exception, taken in Hyp mode. 


Resets to 0. 


Ifthe TCP11 and TCP10 fields are set to different values, the behavior is the same as if both 
fields were set to the value of TCP10, in all respects other than the value read back by explicitly 
reading TCP11. 


TCP10, [10] 
Trap CP10. The possible values of each of this bit is: 


© If NSACR.cp10 is set to 1, then Hyp mode can access CP 10, regardless of the value of 
CPACR.cp10. This bit value has no effect on possible use of CP10 from Non-secure EL1 and 
ELO modes. 


1 Trap valid Non-secure accesses to CP10 to Hyp mode. 
Any otherwise-valid access to CP10 from: 


e ANon-secure EL! or ELO state is trapped to Hyp mode. 
e Hyp mode generates an Undefined Instruction exception, taken in Hyp mode. 
Resets to 0. 


If the TCP11 and TCP 10 fields are set to different values, the behavior is the same as if both 
fields were set to the value of TCP 10, in all respects other than the value read back by explicitly 


reading TCP11. 
[9:0] 

Reserved, RESI. 
To access the HCPTR: 


MRC p15,4,<Rt>,c1,c1,2 ; Read HCPTR into Rt 
MCR p15,4,<Rt>,c1,c1,2 ; Write Rt to HCPTR 


Register access is encoded as follows: 
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Table B1-45 HCPTR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 100 | 0001 |0001 | 010 
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Purpose 


B1 AArch32 system registers 
B1.61 Hyp Configuration Register 


Provides configuration controls for virtualization, including defining whether various Non- 


secure operations are trapped to Hyp mode. 
Usage constraints 
This register is accessible as follows: 


























ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- |. [RW [RW : 











Configurations 


HCR is architecturally mapped to AArch64 register HCR_EL2[31:0]. See 82.48 Hypervisor 


Configuration Register, EL2 on page B2-421. 
Attributes 
HCR is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16.15 14 13 12 11 109 8 76543 210 











































































































RESO a |b VM 
TRVM SWIO 
HCD PTW 
RESO FMO 
TGE IMO 
TVM AMO 

TTLB VF 
TPU Vi 
TPC VA 
TSW FB 

TAC BSU 
TIDCP DC 

TSC TWI 

TID3 TWE 

TID2 TIDO 

TID1 

Figure B1-17 HCR bit assignments 

[31] 


Reserved, RESO. 
TRVM, [30] 
Trap Read of Virtual Memory controls. 


When 1, this causes Reads to the EL1 virtual memory control registers from EL1 to be trapped 


to EL2. This covers the following registers: 


SCTLR, TTBRO, TTBR1, TTBCR, DACR, DFSR, IFSR, DFAR, IFAR, ADFSR, AIFSR, 
PRRR/MAIRO, NMRR/MAIRI, AMAIRO, AMAIR1, and CONTEXTIDR. 


The reset value is 0. 


HCD, [29] 
Hyp Call Disable. The HCD value is: 


@ HVC is enabled at EL1 or EL2. 
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1 HVC is UNDEFINED at all exception levels. 


[28] 
Reserved, RESO. 
TGE, [27] 
Trap General Exceptions. If this bit is set, and SCR_EL3.NS is set, then: 
All exceptions that would be routed to EL1 are routed to EL2. 
e The SCTLR.M bit is treated as 0 regardless of its actual state, other than for the purpose of 
reading the bit. 
e The HCR.FMO, IMO, and AMO bits are treated as 1 regardless of their actual state, other 
than for the purpose of reading the bits. 
e All virtual interrupts are disabled. 
e Any implementation defined mechanisms for signaling virtual interrupts are disabled. 
e An exception return to ELI is treated as an illegal exception return. 


Additionally, if HCR.TGE is 1, the HDCR.{TDRA,TDOSA,TDA} bits are ignored and the 
processor behaves as if they are set to 1, other than for the value read back from HDCR. 


The reset value is 0. 


TVM, [26] 
Trap Virtual Memory controls. When 1, this causes Writes to the EL1 virtual memory control 
registers from EL1 to be trapped to EL2. This covers the following registers: 


SCTLR, TTBRO, TTBR1, TTBCR, DACR, DFSR, IFSR, DFAR, IFAR, ADFSR, AIFSR, 
PRRR/MAIRO, NMRR/MAIRI, AMAIRO, AMAIR1, and CONTEXTIDR. 


The reset value is 0. 


TTLB, [25] 
Trap TLB maintenance instructions. When 1, this causes TLB maintenance instructions 
executed from EL1 that are not UNDEFINED to be trapped to EL2. This covers the following 
instructions: 


TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAATIS, TLBIALL, TLBIMVA, TLBIASID, TLBIMVAA, 
TLBIMVALIS, TLBIMVAALIS, TLBIMVAL, and TLBIMVAAL. 


The reset value is 0. 


TPU, [24] 
Trap Cache maintenance instructions to Point of Unification. When 1, this causes Cache 
maintenance instructions to the point of unification executed from EL1 or ELO that are not 
UNDEFINED to be trapped to EL2. This covers the following instructions: 


ICIMVAU, ICIALLU, ICIALLUIS, and DCCMVAU. 
The reset value is 0. 


TPC, [23] 
Trap Data/Unified Cache maintenance operations to Point of Coherency. When 1, this causes 
Data or Unified Cache maintenance instructions by address to the point of coherency executed 
from EL1 or ELO that are not UNDEFINED to be trapped to EL2. This covers the following 
instructions: 


DCIMVAC, DCCIMVAC, and DCCMVAC. 


The reset value is 0. 
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TSW, [22] 
Trap Data/Unified Cache maintenance operations by Set/Way. When 1, this causes Data or 
Unified Cache maintenance instructions by set/way executed from EL1 that are not UNDEFINED to 
be trapped to EL2. This covers the following instructions: 


DCISwW, DCCSW, and DCCISW. 
The reset value is 0. 


TAC, [21] 
Trap ACTLR accesses. When this bit is set to 1, any valid Non-secure access to the ACTLR is 
trapped to Hyp mode. 


The reset value is 0. 


TIDCP, [20] 
Trap Implementation Dependent functionality. When 1, this causes accesses to all CP15 MCR 
and MRC instructions executed from EL1, to be trapped to EL2 as follows: 
e CRnis 9, Opcodel is 0 to 7, CRm is c0, cl, c2, c5, c6, c7, c8, opcode? is 0 to 7. 
e CRn is 10, Opcodel is 0 to 7, CRm is c0, cl, c4, c8}, opcode? is 0 to 7. 
e CRnis 11, Opcodel is 0 to 7, CRm is c0 to c8, or c15, opcode? is 0 to 7. 


Accesses from ELO are UNDEFINED. 
Resets to 0. 


TSC, [19] 
Trap SMC instruction. When this bit is set to 1, any attempt from a Non-secure EL] state to 
execute an SMC instruction, that passes its condition check if it is conditional, is trapped to Hyp 
mode. 


The reset value is 0. 


TID3, [18] 
Trap ID Group 3. When 1, this causes reads to the following registers executed from EL1 to be 
trapped to EL2: 
ID_PFRO, ID_PFR1, ID_DFRO, ID_AFRO, ID MMFRO, ID MMFR1, ID MMFR2, 
ID_MMFR3, ID_ISARO, ID_ISAR1, ID ISAR2, ID_ISAR3, ID_ISAR4, ID ISAR5, MVFRO, 
MVFRI, and MVFR2. Also MRC instructions to any of the following encodings: 


e CP15, OPC1 is 0, CRn is 0, CRm is c3, c4, c5, c6, or c7, and Opc2 is 0 or 1. 
e CP15, Opcl is 0, CRn is 0, CRm is c3, and Opc2 is 2. 
e CP15, Opcl is 0, CRn is 0, CRm is 5, and Opc2 is 4 or 5. 


The reset value is 0. 


TID2, [17] 
Trap ID Group 2. When 1, this causes reads (or writes to CSSELR) to the following registers 
executed from EL1 or ELO if not UNDEFINED to be trapped to EL2: 


CTR, CCSIDR, CLIDR, and CSSELR. 
The reset value is 0. 


TID1, [16] 
Trap ID Group 1. When 1, this causes reads to the following registers executed from EL1 to be 
trapped to EL2: 


TCMTR, TLBTR, AIDR, and REVIDR. 


The reset value is 0. 
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TIDO, [15] 
Trap ID Group 0. When 1, this causes reads to the following registers executed from EL1 or 
ELO if not UNDEFINED to be trapped to EL2: 


FPSID and JIDR. 
The reset value is 0. 


TWE, [14] 
Trap WFE. When 1, this causes the WFE instruction executed from EL1 or ELO to be trapped to 
EL2 if the instruction would otherwise cause suspension of execution. For example, if the event 
register is not set: 


The reset value is 0. 


TWI, [13] 
Trap WFI. When 1, this causes the WFI instruction executed from EL1 or ELO to be trapped to 
EL2 if the instruction would otherwise cause suspension of execution. For example, if there is 
not a pending WFI wake-up event: 


The reset value is 0. 


DC, [12] 
Default cacheable. When this bit is set to 1, and the Non-secure EL1 and ELO stage 1 MMU is 
disabled, the memory type and attributes determined by the stage 1 translation is Normal, Non- 
shareable, Inner Write-Back Write-Allocate, Outer Write-Back Write-Allocate. 


The reset value is 0. 


BSU, [11:10] 
Barrier Shareability upgrade. The value in this field determines the minimum shareability 
domain that is applied to any barrier executed from EL1 or ELO. The possible values are: 


boð No effect. 

@b@1 Inner Shareable. 
@b1@ Outer Shareable. 
b11 Full System. 


The reset value is 0. 


FB, [9] 
Force broadcast. When 1, this causes the following instructions to be broadcast within the Inner 
Shareable domain when executed from Non-secure EL1: 
TLBIALL, TLBIMVA, TLBIASID, TLBIMVAA, BPIALL, and ICIALLU. 


The reset value is 0. 


VA, [8] 
Virtual Asynchronous Abort exception. When the AMO bit is set to 1, setting this bit signals a 
virtual Asynchronous Abort exception to the Guest OS, when the processor is executing in Non- 
secure state at ELO or EL1. 


The Guest OS cannot distinguish the virtual exception from the corresponding physical 
exception. 


The reset value is 0. 
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VI [7] 
Virtual IRQ exception. When the IMO bit is set to 1, setting this bit signals a virtual IRQ 
exception to the Guest OS, when the processor is executing in Non-secure state at ELO or ELI. 


The Guest OS cannot distinguish the virtual exception from the corresponding physical 
exception. 


The reset value is 0. 


VF, [6] 
Virtual FIQ exception. When the FMO bit is set to 1, setting this bit signals a virtual FIQ 
exception to the Guest OS, when the processor is executing in Non-secure state at ELO or ELI. 


The Guest OS cannot distinguish the virtual exception from the corresponding physical 
exception. 


The reset value is 0. 


AMO, [5] 
Asynchronous Abort Mask Override. When this is set to 1, it overrides the effect of CPSR.A, 
and enables virtual exception signaling by the VA bit. 


The reset value is 0. 


IMO, [4] 
IRQ Mask Override. When this is set to 1, it overrides the effect of CPSR.I, and enables virtual 
exception signaling by the VI bit. 


The reset value is 0. 


FMO, [3] 
FIQ Mask Override. When this is set to 1, it overrides the effect of CPSR.F, and enables virtual 
exception signaling by the VF bit. 


The reset value is 0. 


PTW, [2] 
Protected Table Walk. When 1, if the stage 2 translation of a translation table access made as 
part of a stage | translation table walk at ELO or EL1 maps that translation table access to 
Device memory, the access is faulted as a stage 2 Permission fault. 


The reset value is 0. 


SWIO, [1] 
Set/Way Invalidation Override. When 1, this causes EL1 execution of the data cache invalidate 
by set/way instruction to be treated as data cache clean and invalidate by set/way. DCISW is 
executed as DCCISW. 


This bit is RES1. 


VM, [0] 
Second stage of Translation enable. When 1, this enables the second stage of translation for 
execution in EL1 and ELO. 


The reset value is 0. 
To access the HCR: 


MRC p15, 4, <Rt>, c1, c1, @; Read Hyp Configuration Register 
MCR p15, 4, <Rt>, c1, c1, @; Write Hyp Configuration Register 


Register access is encoded as follows: 
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Table B1-46 HCR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 100 | 0001 |0001 | 000 
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B1.62 Hyp Configuration Register 2 


The HCR2 characteristics are: 


Purpose 


Provides additional configuration controls for virtualization. 


Usage constraints 


This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
: at he - |RW | RW z 





























Configurations 


HCR2 is architecturally mapped to AArch64 register HCR_EL2[63:32]. See B2.48 Hypervisor 
Configuration Register, EL2 on page B2-421. 


This register is accessible only at EL2 or EL3. 


Attributes 


[31:2] 


ID, [1] 


CD, [0] 


HCR2 is a 32-bit register. 
31 2 10 


mm 
Le CD 
ID 
Figure B1-18 HCR2 bit assignments 


Reserved, RESO. 


Stage 2 Instruction cache disable. When HCR.VM is 1, this forces all stage 2 translations for 
instruction accesses to Normal memory to be Non-cacheable for the EL1/EL0 translation 
regime. The possible values are: 


© No effect on the stage 2 of the EL1/ELO translation regime for instruction accesses. 


1 Forces all stage 2 translations for instruction accesses to Normal memory to be Non- 
cacheable for the EL0/EL1 translation regime. 


Stage 2 Data cache disable. When HCR.VM is 1, this forces all stage 2 translations for data 
accesses and translation table walks to Normal memory to be Non-cacheable for the EL1/EL0 
translation regime. The possible values are: 


© No effect on the stage 2 of the EL1/ELO translation regime for data accesses and translation 
table walks. 


1 Forces all stage 2 translations for data accesses and translation table walks to Normal 
memory to be Non-cacheable for the ELO/EL1 translation regime. 


To access the HCR2: 


MRC p15,4,<Rt>,c1,c1,4 ; Read HCR2 into Rt 
MCR p15,4,<Rt>,c1,c1,4 ; Write Rt to HCR2 


Register access is encoded as follows: 
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Table B1-47 HCR2 access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 100 | 0001 |0001 | 100 
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B1.63 Hyp Debug Control Register 
The HDCR characteristics are: 


Purpose 
Controls the trapping to Hyp mode of Non-secure accesses, at EL1 or lower, to functions 
provided by the debug and trace architectures and the Performance Monitor. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) (S) (SCR.NS = 1) | (SCR.NS = 0) 
z = Js - |RW | RW : 


























Configurations 
HDCR is architecturally mapped to AArch64 register MDCR_EL2. See B2.80 Monitor Debug 
Configuration Register, EL2 on page B2-483. 





This register is accessible only at EL2 or EL3. 














Attributes 
HDCR is a 32-bit register. 
31 1211109 8 7 6 5 4 
L 
ne 
HPME 
TDE 
TDA 
TDOSA 
TDRA 
Figure B1-19 HDCR bit assignments 
[31:12] 
Reserved, RESO. 
TDRA, [11] 


Trap debug ROM address register access. 


© Has no effect on accesses to debug ROM address registers from EL1 and ELO. 
1 Trap valid Non-secure EL1 and ELO access to debug ROM address registers to Hyp mode. 


When this bit is set to 1, any valid Non-secure access to the following registers is trapped to 


Hyp mode: 
e DBGDRAR. 
e DBGDSAR. 


If HCR.TGE is 1 or HDCR.TDE is 1, then this bit is ignored and treated as though it is 1 other 
than for the value read back from HDCR. 


On Warm reset, the field resets to 0. 


TDOSA, [10] 
Trap Debug OS-related register access: 


© Has no effect on accesses to CP14 Debug registers. 
1 Trap valid Non-secure accesses to CP14 OS-related Debug registers to Hyp mode. 
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When this bit is set to 1, any valid Non-secure CP14 access to the following OS-related Debug 
registers is trapped to Hyp mode: 


e DBGOSLSR. 
e DBGOSLAR. 
e DBGOSDLR. 
e DBGPRCR. 


If HCR.TGE is 1 or HDCR.TDE is 1, then this bit is ignored and treated as though it is 1 other 
than for the value read back from HDCR. 


On Warm reset, the field resets to 0. 


TDA, [9] 
Trap Debug Access: 


© Has no effect on accesses to CP14 Debug registers. 

1 Trap valid Non-secure accesses to CP14 Debug registers to Hyp mode. 

When this bit is set to 1, any valid access to the CP14 Debug registers, other than the registers 
trapped by the TDRA and TDOSA bits, is trapped to Hyp mode. 


If HCR.TGE is 1 or HDCR.TDE is1, then this bit is ignored and treated as though it is 1 other 
than for the value read back from HDCR. 


On Warm reset, the field resets to 0. 


TDE, [8] 
Trap Debug Exceptions: 


© Has no effect on Debug exceptions. 


1 Route Non-secure Debug exceptions to Hyp mode. 


When this bit is set to 1, any Debug exception taken in Non-secure state is trapped to Hyp mode. 


If HCR.TGE is 1, then this bit is ignored and treated as though it is 1 other than for the value 
read back from HDCR. This bit resets to 0. 


HPME, [7] 
Hypervisor Performance Monitor Enable: 


@ Hyp mode performance monitor counters disabled. 
1 Hyp mode performance monitor counters enabled. 


When this bit is set to 1, access to the performance monitors that are reserved for use from Hyp 
mode is enabled. For more information, see the description of the HPMN field. 


The reset value of this bit is UNKNOWN. 


TPM, [6] 
Trap Performance Monitor accesses: 
© Has no effect on performance monitor accesses. 
1 Trap valid Non-secure performance monitor accesses to Hyp mode. 
When this bit is set to 1, any valid Non-secure access to the Performance Monitor registers is 


trapped to Hyp mode. This bit resets to 0. See the ARM® Architecture Reference Manual ARMVv8, 
for ARMVv8-A architecture profile for more information. 


TPMCR, [5] 
Trap Performance Monitor Control Register accesses: 


© Has no effect on PMCR accesses. 
1 Trap valid Non-secure PMCR accesses to Hyp mode. 
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When this bit is set to 1, any valid Non-secure access to the PMCR is trapped to Hyp mode. 
This bit resets to 0. See the ARM® Architecture Reference Manual ARMv8, for ARMV8-A 
architecture profile for more information. 


HPMN, [4:0] 


Hyp Performance Monitor count. Defines the number of Performance Monitors counters that are 
accessible from Non-secure EL1 and ELO modes if unprivileged access is enabled. 


In Non-secure state, HPMN divides the Performance Monitors counters as follows. If software 
is accessing Performance Monitors counter n then, in Non-secure state: 


For example, If PMnEVCNTR is performance monitor counter n then, in Non-secure state: 


¢ Ifn is in the range 0 < n < HPMN, the counter is accessible from EL1 and EL2, and from 
ELO if unprivileged access to the counters is enabled. 

¢ Ifn is in the range HPMN < n <PMCR.N, the counter is accessible only from EL2. The 
HPME bit enables access to the counters in this range. 


If this field is set to 0, or to a value larger than PMCR.N, then the behavior in Non-secure ELO 
and EL] is CONSTRAINED UNPREDICTABLE, and one of the following must happen: 


¢ The number of counters accessible is an UNKNOWN non-zero value less than PMCR.N. 
e There is no access to any counters. 


For reads of HDCR.HPMN by EL2 or higher, if this field is set to 0 or to a value larger than 

PMCR.N, the processor must return a CONSTRAINED UNPREDICTABLE value being one of: 

e PMCRN. 

e The value that was written to HDCR.HPMN. 

e (The value that was written to HDCR.HPMN) modulo 2h, where h is the smallest number of 
bits required for a value in the range 0 to PMCR.N. 


This field resets to @x6. 


To access the HDCR: 


MRC p15,4,<Rt>,c1,c1,1 ; Read HDCR into Rt 
MCR p15,4,<Rt>,c1,c1,1 ; Write Rt to HDCR 


Register access is encoded as follows: 


Table B1-48 HDCR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 100 |0001 |0001 | 001 
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B1.64 Hyp Data Fault Address Register 


Hyp Data Fault Address Register 


The HDFAR characteristics are: 


Purpose 
Holds the virtual address of the faulting address that caused a synchronous Data Abort exception 
that is taken to Hyp mode. 

Usage constraints 
This register is accessible as follows: 





ELO | ELO | EL1 | EL1 | EL2 | EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) 





- - - RW | RW |- 

















An execution in a Non-secure EL1 state, or in Secure state, makes the HDFAR UNKNOWN. 


Configurations 
HDFAR is architecturally mapped to AArch64 register FAR_EL2[31:0] when EL3 is AArch64. 
See B2.45 Fault Address Register, EL2 on page B2-418. 


HDFAR (S) is architecturally mapped to AArch32 register DFAR (S). See B/.48 Data Fault 
Address Register on page B1-212. 


Attributes 
HDFAR is a 32-bit register. 


31 0 


VA of faulting address of synchronous Data Abort exception 


Figure B1-20 HDFAR bit assignments 


VA, [31:0] 
The Virtual Address of faulting address of synchronous Data Abort exception. 


To access the HDFAR: 


MRC p15, 4, <Rt>, c6, c@, @ ; Read HDFAR into Rt 
MCR p15, 4, <Rt>, c6, c@, @ ; Write Rt to HDFAR 


Register access is encoded as follows: 


Table B1-49 HDFAR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 100 | 0110} 0000 | 000 
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Hyp Instruction Fault Address Register 


The HIFAR characteristics are: 


Purpose 
Holds the virtual address of the faulting address that caused a synchronous Prefetch Abort 
exception that is taken to Hyp mode. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
> TE - |RW | RW : 





























Execution in any Non-secure mode other than Hyp mode makes HPFAR UNKNOWN. 


Configurations 
HIFAR is architecturally mapped to AArch64 register FAR_EL2[63:32]. See B2.45 Fault 
Address Register, EL2 on page B2-418. 


HIFAR is architecturally mapped to AArch32 register IFAR (S). See B/.86 Instruction Fault 
Address Register on page B1-282. 


Attributes 
HIFAR is a 32-bit register. 


31 0 


VA of faulting address of synchronous Prefetch Abort exception 


Figure B1-21 HIFAR bit assignments 


VA, [31:0] 
The Virtual Address of faulting address of synchronous Prefetch Abort exception. 


To access the HIFAR: 


MRC p15, 4, <Rt>, c6, c@, 2 ; Read HIFAR into Rt 
MCR p15, 4, <Rt>, c6, c@, 2 ; Write Rt to HIFAR 


Register access is encoded as follows: 


Table B1-50 HIFAR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 100 | 0110} 0000 | 010 
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B1.66 Hyp IPA Fault Address Register 
The HPFAR characteristics are: 


Purpose 


Holds the faulting IPA for some aborts on a stage 2 translation taken to Hyp mode. 
Usage constraints 


This register is accessible as follows: 








ELO |ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |. |. |. [Rw [RW : 





























Execution in any Non-secure mode other than Hyp mode makes HPFAR UNKNOWN. 


Configurations 


HPFAR is architecturally mapped to AArch64 register HPFAR_EL2[31:0]. See 
B2.49 Hypervisor IPA Fault Address Register, EL2 on page B2-427. 
Attributes 


HPFAR is a 32-bit register. 


31 4 3 0 


FIPA[39:12] 


Figure B1-22 HPFAR bit assignments 
FIPA [39:12], [31:4] 


Bits [39:12] of the faulting intermediate physical address 
[3:0] 
Reserved, RESO 


To access the HPFAR: 


MRC p15, 4, <Rt>, c6, c@, 4 ; Read HPFAR into Rt 
MCR p15, 4, <Rt>, c6, c@, 4 ; Write Rt to HPFAR 


Register access is encoded as follows: 


Table B1-51 HPFAR access encoding 





coproc | opc1 | CRn | CRm | opc2 




















1111 100 | 0110} 0000 | 100 
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B1.67 Hyp System Control Register 
The HSCTLR characteristics are: 


Purpose 
Provides top level control of the system operation in Hyp mode. This register provides Hyp 
mode control of features controlled by the Banked SCTLR bits, and shows the values of the 
non-Banked SCTLR bits. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |. |. |. [Rw [RW ’ 





























Configurations 
HSCTLR is architecturally mapped to AArch64 register SCTLR_EL2. See B2.9/ System 
Control Register, EL2 on page B2-510. 

Attributes 
HSCTLR is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16.15 14 13 1211 10 9 8 76543210 


L— RESO RESO—! resO—! |- RES1 RES1- ama | 
WXN Baio ~a 
RES1 RESO 


CP15BEN 





Figure B1-23 HSCTLR bit assignments 


[31] 
Reserved, RESO. 

TE, [30] 
Thumb Exception enable. This bit controls whether exceptions taken in Hyp mode are taken in 
A32 or T32 state: 


(3 Exceptions taken in A32 state. 
1 Exceptions taken in T32 state. 


[29:28] 
Reserved, RESI. 

[27:26] 
Reserved, RESO. 

EE, [25] 
Exception Endianness. The value of this bit defines the value of the CPSR.E bit on entry to an 
exception vector, including reset. This value also indicates the endianness of the translation table 
data for translation table lookups: 


@ Little endian. 

1 Big endian. 
[24] 

Reserved, RESO. 
[23:22] 

Reserved, RESI. 





ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-244 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
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FI, [21] 
Fast Interrupts configuration enable bit. This bit can be used to reduce interrupt latency by 
disabling implementation-defined performance features. 


This bit is not implemented, REso. 


[20] 
Reserved, RESO. 
WXN, [19] 
Write permission implies Execute Never (XN). This bit can be used to require all memory 
regions with write permission to be treated as XN: 
(3 Regions with write permission are not forced to XN. 


1 Regions with write permission are forced to XN. 


The WXN bit is permitted to be cached in a TLB. 


[18] 

Reserved, RES1. 
[17] 

Reserved, RESO. 
[16] 


Reserved, RES1. 
[15:13] 
Reserved, RESO. 
I, [12] 
Instruction cache enable. This is an enable bit for instruction caches at EL2: 
@ Instruction caches disabled at EL2. If HSCTLR.M is set to 0, instruction accesses from 
stage 1 of the EL2 translation regime are to Normal memory, Outer Shareable, Inner 
Non-cacheable, Outer Non-cacheable. 
1 Instruction caches enabled at EL2. If HSCTLR.M is set to 0, instruction accesses from 
stage 1 of the EL2 translation regime are to Normal memory, Outer Shareable, Inner 
Write-Through, Outer Write-Through. 


When this bit is 0, all EL2 Normal memory instruction accesses are Non-cacheable. 


If this register is at the highest exception level implemented, field resets to 0. Otherwise, its 
reset value is UNKNOWN. 
[11] 
Reserved, RES1. 
[10:9] 
Reserved, RESO. 
SED, [8] 
SETEND Disable: 
@ The SETEND instruction is available. 


1 The SETEND instruction is UNALLOCATED. 


ITD, [7] 
IT Disable: 


© The IT instruction functionality is available. 


e 


All encodings of the IT instruction with hw1[3:0]!=1000 are UNDEFINED and treated as 
unallocated. All encodings of the subsequent instruction with the following values for hw1 
are UNDEFINED (and treated as unallocated): 


11XXXXXXXXXXXXXX All 32-bit instructions, B(2), B(1), Undefined, SVC, Load/Store 
multiple 


1X11XXXXXXXXXXXX Miscellaneous 16-bit instructions 
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1Xx100XXXXXXXXXX ADD Rd, PC, #imm 
01001XXXXXXXXXXX LDR Rd, [PC, #imm] 
@100x1xxx1111xxx ADD(4),CMP(3), MOV, BX pc, BLX pc 
@10001xx1xxxx111 ADD(4),CMP(3), MOV 


[6] 
Reserved, RESO. 
CP15BEN, [5] 
CP15 barrier enable: 
(3 CP15 barrier operations disabled. Their encodings are UNDEFINED. 
1 CP15 barrier operations enabled. 
[4:3] 
Reserved, RES1. 
C, [2] 
Cache enable. This is an enable bit for data and unified caches at EL2: 
e Data and unified caches disabled at EL2. 
1 Data and unified caches enabled at EL2. 


When this bit is 0, all EL2 Normal memory data accesses and all accesses to the EL2 translation 
tables are Non-cacheable. 


If this register is at the highest exception level implemented, field resets to 0. Otherwise, its 
reset value is UNKNOWN. 


A, [1] 
Alignment check enable. This is the enable bit for Alignment fault checking: 


(3 Alignment fault checking disabled. 

1 Alignment fault checking enabled. 

When this bit is 1, all instructions that load or store one or more registers, other than load/store 
exclusive and load-acquire/store-release, have an alignment check that the address being 


accessed is aligned to the size of the data element(s) being accessed. If this check fails it causes 
an Alignment fault, that is taken as a Data Abort exception. 


Load/store exclusive and load-acquire/store-release instructions have this alignment check 
regardless of the value of the A bit. 


If this register is at the highest exception level implemented, field resets to 0. Otherwise, its 
reset value is UNKNOWN. 


M, [0] 
MMU enable. This is a global enable bit for the EL2 stage 1 MMU: 


(3 EL2 stage 1 MMU disabled. 
1 EL2 stage 1 MMU enabled. 


If this register is at the highest exception level implemented, field resets to 0. Otherwise, its 
reset value is UNKNOWN. 


To access the HSCTLR: 


MRC p15,4,<Rt>,c1,c@,@ ; Read HSCTLR into Rt 
MCR p15,4,<Rt>,c1,c@,® ; Write Rt to HSCTLR 


Register access is encoded as follows: 
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B1.67 Hyp System Control Register 


Table B1-52 HSCTLR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 100 | 0001 |0000 | 000 
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B1.68 Hyp Syndrome Register 
The HSR characteristics are: 


Purpose 

Holds syndrome information for an exception taken to Hyp mode. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
: at he - |RW|RW z 





























Configurations 
HSR is architecturally mapped to AArch64 register ESR_EL2. See B2.42 Exception Syndrome 
Register, EL2 on page B2-413. 


This register is accessible only at EL2 or EL3. 


Attributes 
HSR is a 32-bit register. 
31 26 25 24 0 
= IL 
Figure B1-24 HSR bit assignments 
EC, [31:26] 


Exception class. The exception class for the exception that is taken in Hyp mode. See the ARM® 
Architecture Reference Manual ARMV8, for ARMvS8-A architecture profile for more information. 
IL, [25] 
Instruction length. See the ARM® Architecture Reference Manual ARMVv%, for ARMv8-A 
architecture profile for more information. 
ISS, [24:0] 
Instruction specific syndrome. See the ARM” Architecture Reference Manual ARMvé, for 
ARMv8-A architecture profile for more information. The interpretation of this field depends on 
the value of the EC field. See B/.52 Encoding of ISS[24:20] when HSR[31:30] is 0b00 
on page B1-218. 
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B1.69 Hyp System Trap Register 

































































B1.69 Hyp System Trap Register 
The HSTR characteristics are: 
Purpose 
Controls trapping to Hyp mode of Non-secure accesses, at EL1 or lower, of use of T32EE, or the 
CP15 primary registers, {c0-c3,c5-cl3,c15}. 
Usage constraints 
This register is accessible as follows: 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
z x Js - |RW | RW : 
Configurations 
HSTR is architecturally mapped to AArch64 register HSTR_EL2. See B2.50 Hyp System Trap 
Register, EL2 on page B2-428. 
This register is accessible only at EL2 or EL3. 
Attributes 
HSTR is a 32-bit register. 
31 17161514131211109 876543210 
Figure B1-25 HSTR bit assignments 
[31:17] 
Reserved, RESO. 
TTEE, [16] 
Trap T32EE. This value is: 
(3 T32EE is not supported. 
T15, [15] 
Trap coprocessor primary register CRn = 15. The possible values are: 
(3 Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 15 to Hyp 
mode. 
The reset value is 0. 
[14] 
Reserved, RESO. 
T13, [13] 
Trap coprocessor primary register CRn = 13. The possible values are: 
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B1.69 Hyp System Trap Register 


) Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 13 to Hyp 
mode. 


The reset value is 0. 


T12, [12] 
Trap coprocessor primary register CRn = 12. The possible values are: 


() Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 12 to Hyp 
mode. 


The reset value is 0. 


T11, [11] 
Trap coprocessor primary register CRn = 11. The possible values are: 


(2) Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 11 to Hyp 
mode. 


The reset value is 0. 


T10, [10] 
Trap coprocessor primary register CRn = 10. The possible values are: 


2] Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 10 to Hyp 
mode. 


The reset value is 0. 


T9, [9] 
Trap coprocessor primary register CRn = 9. The possible values are: 


2] Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 9 to Hyp mode. 


The reset value is 0. 


T8, [8] 
Trap coprocessor primary register CRn = 8. The possible values are: 


(2) Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 8 to Hyp mode. 


The reset value is 0. 


T7, [7] 
Trap coprocessor primary register CRn = 7. The possible values are: 


() Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 7 to Hyp mode. 


The reset value is 0. 


T6, [6] 
Trap coprocessor primary register CRn = 6. The possible values are: 


2] Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 6 to Hyp mode. 


The reset value is 0. 
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T5, [5] 
Trap coprocessor primary register CRn = 5. The possible values are: 
() Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 5 to Hyp mode. 


The reset value is 0. 


[4] 
Reserved, RESO. 
T3, [3] 
Trap coprocessor primary register CRn = 3. The possible values are: 


2] Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 3 to Hyp mode. 
The reset value is 0. 


T2, [2] 
Trap coprocessor primary register CRn = 2. The possible values are: 


2] Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 2 to Hyp mode. 
The reset value is 0. 


T1, [1] 
Trap coprocessor primary register CRn = 1. The possible values are: 


[2] Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 1 to Hyp mode. 
The reset value is 0. 


TO, [0] 
Trap coprocessor primary register CRn = 0. The possible values are: 


2] Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 0 to Hyp mode. 


The reset value is 0. 
To access the HSTR: 


MRC p15, 4, <Rt>, c1, c1, 3 ; Read HSTR into Rt 
MCR p15, 4, <Rt>, c1, c1, 3 ; Write Rt to HSTR 


Register access is encoded as follows: 


Table B1-53 HSTR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 100 |0001 |0001 | 011 























ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-251 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.70 Hyp Translation Control Register 


B1.70 Hyp Translation Control Register 
The HTCR characteristics are: 


Purpose 
Controls translation table walks required for the stage 1 translation of memory accesses from 
Hyp mode, and holds cacheability and shareability information for the accesses. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) (S) (SCR.NS = 1) | (SCR.NS = 0) 
z x Js - |RW | RW : 





























Configurations 
HTCR is architecturally mapped to AArch64 register TCR_EL2. See B2.95 Translation Control 
Register, EL2 on page B2-519. 

Attributes 
HTCR is a 32-bit register. 


31 30 24 23 22 14131211109 8 7 32 0 
L_res1 L_res1 ORGNo —! L_IRGNO 


Figure B1-26 HTCR bit assignments 
[31] 
Reserved, RESI. 
[30:24] 
Reserved, RESO. 
[23] 
Reserved, RESI. 
[22:14] 
Reserved, RESO. 
SHO, [13:12] 
Shareability attribute for memory associated with translation table walks using TTBRO. The 
possible values are: 
@bee@  Non-shareable. 
@be@1 Reserved. 
@b1@ Outer shareable. 


@b11 Inner shareable. 


ORGNDO, [11:10] 
Outer cacheability attribute for memory associated with translation table walks using TTBRO. 
The possible values are: 
@bee@ Normal memory, Outer Non-cacheable. 
@b@1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b1@ Normal memory, Outer Write-Through Cacheable. 
@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 
IRGNO, [9:8] 


Inner cacheability attribute for memory associated with translation table walks using TTBRO. 
The possible values are: 
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B1 AArch32 system registers 
B1.70 Hyp Translation Control Register 


Normal memory, Inner Write-Back Write-Allocate Cacheable. 


Normal memory, Inner Write-Through Cacheable. 


Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


Reserved, RESO. 


Q@bee 
Q@be1 
0b10 
0b11 
[7:3] 
TOSZ, [2:0] 


Size offset of the memory region addressed by TTBRO. The region size is 20?-TS!2E) bytes, 


The processor does not use the implementation-defined bit, HTCR[30], so this bit is REso. 


To access the HTCR: 


MRC p15, 4, <Rt>, c2, c@, 2; Read HTCR into Rt 
MCR p15, 4, <Rt>, c2, c@, 2; Write Rt to HTCR 


Register access is encoded as follows: 


Table B1-54 HTCR access encoding 
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B1.71 Hyp Vector Base Address Register 
The HVBAR characteristics are: 


Purpose 

Holds the exception base address for any exception that is taken to Hyp mode. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |. |. |- [Rw [RW : 





























Configurations 


The HVBAR is architecturally mapped to the AArch64 VBAR_EL2[31:0]. See B2./0/ Vector 
Base Address Register, EL2 on page B2-527. 

Attributes 
HVBAR is a 32-bit register. 


31 5 4 0 


Vector Base Address 


Figure B1-27 HVBAR bit assignments 


Vector Base Address, [31:5] 
Bits[31:5] of the base address of the exception vectors, for exceptions taken in this exception 
level. Bits[4:0] of an exception vector are the exception offset. 

[4:0] 
Reserved, RESO. 


To access the HVBAR: 


MRC p15, 4, <Rt>, c12, c@, @ ; Read HVBAR into Rt 
MCR p15, 4, <Rt>, c12, c@, © ; Write Rt to HVBAR 


Register access is encoded as follows: 


Table B1-55 HVBAR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 100 | 1100 |0000 | 000 
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B1.72 Auxiliary Feature Register 0 
ID_AFRO 


The processor does not implement ID_AFRO. This register is always RESo. 
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B1.73 Debug Feature Register 0 
The ID_DFRO characteristics are: 


Purpose 

Provides top level information about the debug system in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- [RO |RO ÍRO IRO RO 





























Must be interpreted with the Main ID Register, MIDR. 


Configurations 
ID_DFRO is architecturally mapped to AArch64 register ID_DFR0_EL1. See B2.56 AArch32 
Debug Feature Register 0, ELI on page B2-440. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_DFR0 is a 32-bit register. 
28 27 24 23 20 19 16 15 12 11 
Figure B1-28 ID_DFRO bit assignments 
[31:28] 


Reserved, RESO. 
PerfMon, [27:24] 
Indicates support for performance monitor model: 


@x3 Support for Performance Monitor Unit version 3 (PMUv3) system registers. 


MProfDbg, [23:20] 
Indicates support for memory-mapped debug model for M profile processors: 


@x@ Processor does not support M profile Debug architecture. 


MMapTre, [19:16] 
Indicates support for memory-mapped trace model: 


@x@ ETM is not implemented. 
@x1 Support for ARM trace architecture, with memory-mapped access. 


In the Trace registers, the ETMIDR gives more information about the implementation. 


CopTre, [15:12] 
Indicates support for coprocessor-based trace model: 


@x@ Processor does not support ARM trace architecture, with CP14 access. 
[11:8] 
Reserved, RAZ. 


CopSDbg, [7:4] 
Indicates support for coprocessor-based Secure debug model: 


@x6 Processor supports v8 Debug architecture, with CP14 access. 
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CopDbg, [3:0] 
Indicates support for coprocessor-based debug model: 


@x6 Processor supports v8 Debug architecture, with CP14 access. 
To access the ID_DFRO: 
MRC p15,0,<Rt>,c@,c1,2 ; Read ID_DFR@ into Rt 


Register access is encoded as follows: 


B1 AArch32 system registers 
B1.73 Debug Feature Register 0 


Table B1-56 ID_DFRO access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0000 | 0001 | 010 
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B1 AArch32 system registers 
B1.74 Instruction Set Attribute Register 0 


B1.74 Instruction Set Attribute Register 0 
The ID_ISARO characteristics are: 


Purpose 

Provides information about the instruction sets implemented by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 





























Must be interpreted with ID_ISAR1, ID_ISAR2, ID_ISAR3, ID_ISAR4, and ID_ISARS. See: 
¢ B1.75 Instruction Set Attribute Register 1 on page B1-260 
¢ B1.76 Instruction Set Attribute Register 2 on page B1-262 
¢ B1.77 Instruction Set Attribute Register 3 on page B1-264 
¢ B1.78 Instruction Set Attribute Register 4 on page B1-266 
¢ B1.79 Instruction Set Attribute Register 5 on page B1-268 


Configurations 
ID_ISARO is architecturally mapped to AArch64 register ID ISARO_EL1. See 82.57 AArch32 
Instruction Set Attribute Register 0, ELI on page B2-442. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_ISARO is a 32-bit register. 


31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 





Figure B1-29 ID_ISARO bit assignments 


[31:28] 
Reserved, RESO. 
Divide, [27:24] 
Indicates the implemented Divide instructions: 
@x2 e SDIV and UDIV in the T32 instruction set. 
e SDIV and UDIV in the A32 instruction set. 


Debug, [23:20] 
Indicates the implemented Debug instructions: 
0x1 BKPT. 
Coproc, [19:16] 
Indicates the implemented Coprocessor instructions: 


exe None implemented, except for separately attributed by the architecture including 
CP15, CP14, Advanced SIMD and floating-point. 


CmpBranch, [15:12] 
Indicates the implemented combined Compare and Branch instructions in the T32 instruction 
set: 


0x1 CBNZ and CBZ. 


Bitfield, [11:8] 
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B1 AArch32 system registers 
B1.74 Instruction Set Attribute Register 0 


Indicates the implemented bit field instructions: 
@x1 BFC, BFI, SBFX, and UBFX. 


BitCount, [7:4] 
Indicates the implemented Bit Counting instructions: 


0x1 CLZ. 


Swap, [3:0] 
Indicates the implemented Swap instructions in the A32 instruction set: 


exe None implemented. 
To access the ID_ISARO: 
MRC p15, ©, <Rt>, c@, c2, @ ; Read ID_ISAR@ into Rt 


Register access is encoded as follows: 


Table B1-57 ID_ISARO access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0010 | 000 
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B1 AArch32 system registers 
B1.75 Instruction Set Attribute Register 1 


B1.75 Instruction Set Attribute Register 1 
The ID_ISARI characteristics are: 


Purpose 

Provides information about the instruction sets implemented by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 





























Must be interpreted with ID_ISARO, ID_ISAR2, ID_ISAR3, ID_ISAR4 and ID_ISARS. See: 
¢ B1.74 Instruction Set Attribute Register 0 on page B1-258 
¢ B1.76 Instruction Set Attribute Register 2 on page B1-262 
¢ B1.77 Instruction Set Attribute Register 3 on page B1-264 
¢ B1.78 Instruction Set Attribute Register 4 on page B1-266 
¢ B1.79 Instruction Set Attribute Register 5 on page B1-268 


Configurations 
ID_ISAR1 is architecturally mapped to AArch64 register ID ISAR1_EL1. See B2.58 AArch32 
Instruction Set Attribute Register 1, ELI on page B2-444. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_ISAR1 is a 32-bit register. 


28 27 24 23 20 19 16 15 12 11 


Figure B1-30 ID_ISAR1 bit assignments 


Jazelle, [31:28] 
Indicates the implemented Jazelle state instructions: 


@x1 The BX3 instruction, and the J bit in the PSR. 


Interwork, [27:24] 
Indicates the implemented Interworking instructions: 


0x3 ¢ The BX instruction, and the T bit in the PSR. 
¢ The BLX instruction. The PC loads have Bx-like behavior. 
e Data-processing instructions in the A32 instruction set with the PC as the 
destination and the S bit clear, have BX-like behavior. 


Immediate, [23:20] 
Indicates the implemented data-processing instructions with long immediates: 


@x1 e The MOVT instruction. 
e The MOV instruction encodings with zero-extended 16-bit immediates. 
e The T32 ADD and SUB instruction encodings with zero-extended 12-bit immediates, 
and other ADD, ADR, and SUB encodings cross-referenced by the pseudocode for 
those encodings. 


IfThen, [19:16] 
Indicates the implemented If-Then instructions in the T32 instruction set: 
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B1 AArch32 system registers 
B1.75 Instruction Set Attribute Register 1 


@x1 The IT instructions, and the IT bits in the PSRs. 


Extend, [15:12] 
Indicates the implemented Extend instructions: 


@x2 ¢ The SXTB, SXTH, UXTB, and UXTH instructions. 
e The SXTB16, SXTAB, SXTAB16, SXTAH, UXTB16, UXTAB, UXTAB16, and UXTAH 
instructions. 


Except_AR, [11:8] 
Indicates the implemented A profile exception-handling instructions: 


0x1 The SRS and RFE instructions, and the A profile forms of the CPS instruction. 


Except, [7:4] 
Indicates the implemented exception-handling instructions in the A32 instruction set: 


0x1 The LDM (exception return), LDM (user registers), and STM (user registers) instruction 
versions. 


Endian, [3:0] 
Indicates the implemented Endian instructions: 


@x1 The SETEND instruction, and the E bit in the PSRs. 


To access the ID_ISAR1: 


MRC p15, ©, <Rt>, c@, c2, 1 ; Read ID_ISAR1 into Rt 


Register access is encoded as follows: 


Table B1-58 ID_ISAR1 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0010 | 001 
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B1 AArch32 system registers 
B1.76 Instruction Set Attribute Register 2 


B1.76 Instruction Set Attribute Register 2 
The ID_ISAR2 characteristics are: 


Purpose 

Provides information about the instruction sets implemented by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 





























Must be interpreted with ID_ISARO, ID_ISAR1, ID_ISAR3, ID_ISAR4 and ID_ISARS. See. 
¢ B1.74 Instruction Set Attribute Register 0 on page B1-258 
¢ B1.75 Instruction Set Attribute Register 1 on page B1-260 
¢ B1.77 Instruction Set Attribute Register 3 on page B1-264 
¢ B1.78 Instruction Set Attribute Register 4 on page B1-266 
¢ B1.79 Instruction Set Attribute Register 5 on page B1-268 


Configurations 


ID_ISAR2 is architecturally mapped to AArch64 register ID ISAR2_EL1. See B2.59 AArch32 
Instruction Set Attribute Register 2, ELI on page B2-446. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_ISAR2 is a 32-bit register. 


28 27 24 23 20 19 16 15 12 11 


MultiAccessint — 


Figure B1-31 ID_ISAR2 bit assignments 


Reversal, [31:28] 
Indicates the implemented Reversal instructions: 


0x2 The REV, REV16, and REVSH instructions. 
The RBIT instruction. 
PSR_AR, [27:24] 
Indicates the implemented A and R profile instructions to manipulate the PSR: 
@x1 The MRS and MSR instructions, and the exception return forms of data-processing 


instructions. 


The exception return forms of the data-processing instructions are: 


e Inthe A32 instruction set, data-processing instructions with the PC as the destination and the 
S bit set. 
¢ Inthe T32 instruction set, the SUBS PC, LR, #N instruction. 


MultU, [23:20] 
Indicates the implemented advanced unsigned Multiply instructions: 


@x2 The UMULL and UMLAL instructions. 


The UMAAL instruction. 
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B1 AArch32 system registers 
B1.76 Instruction Set Attribute Register 2 


Mult, [19:16] 
Indicates the implemented advanced signed Multiply instructions. 


0x3 e The SMULL and SMLAL instructions. 
e The SMLABB, SMLABT, SMLALBB, SMLALBT, SMLALTB, SMLALTT, SMLATB, SMLATT, 
SMLAWB, SMLAWT, SMULBB, SMULBT, SMULTB, SMULTT, SMULWB, SMULWT instructions, 
and the Q bit in the PSRs. 
e The SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, SMLSDX, SMLSLD, SMLSLDX, SMMLA, 
SMMLAR, SMMLS, SMMLSR, SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, and SMUSDX 
instructions. 


Mult, [15:12] 
Indicates the implemented additional Multiply instructions: 
0x2 The MUL instruction. 
The MLA instruction. 


The MLS instruction. 


MultiAccessInt, [11:8] 
Indicates the support for interruptible multi-access instructions: 


exe No support. This means the LDM and STM instructions are not interruptible. 


MemHint, [7:4] 
Indicates the implemented memory hint instructions: 


0x4 The PLD instruction. 
The PLI instruction. 


The PLDW instruction. 


LoadStore, [3:0] 
Indicates the implemented additional load/store instructions: 


@x2 The LDRD and STRD instructions. 


The Load Acquire (LDAB, LDAH, LDA, LDAEXB, LDAEXH, LDAEX, and LDAEXD) and Store 
Release (STLB, STLH, STL, STLEXB, STLEXH, STLEX, and STLEXD) instructions. 


To access the ID_ISAR2: 


MRC p15, ©, <Rt>, c@, c2, 2 ; Read ID_ISAR2 into Rt 


Register access is encoded as follows: 


Table B1-59 ID_ISAR2 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0010 | 010 
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B1 AArch32 system registers 
B1.77 Instruction Set Attribute Register 3 


B1.77 Instruction Set Attribute Register 3 
The ID_ISAR3 characteristics are: 


Purpose 

Provides information about the instruction sets implemented by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 





























Must be interpreted with ID_ISARO, ID_ISAR1, ID_ISAR2, ID_ISAR4, and ID_ISARS. See: 
¢ B1.74 Instruction Set Attribute Register 0 on page B1-258 
¢ B1.75 Instruction Set Attribute Register 1 on page B1-260 
¢ B1.76 Instruction Set Attribute Register 2 on page B1-262 
¢ B1.78 Instruction Set Attribute Register 4 on page B1-266 
¢ B1.79 Instruction Set Attribute Register 5 on page B1-268 


Configurations 
ID_ISAR3 is architecturally mapped to AArch64 register ID ISAR3_EL1. See B2.60 AArch32 
Instruction Set Attribute Register 3, ELI on page B2-448. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_ISAR3 is a 32-bit register. 


28 27 24 23 20 19 16 15 12 11 


ThumbEE | TrueNOP |ThumbCopy| TabBranch a SIMD 


Figure B1-32 ID_ISAR3 bit assignments 


ThumbEE, [31:28] 
Indicates the implemented Thumb Execution Environment (T32EE) instructions: 


@xe None implemented. 
TrueNOP, [27:24] 
Indicates support for True NOP instructions: 
@x1 True NOP instructions in both the A32 and T32 instruction sets, and additional NOP- 
compatible hints. 
ThumbCopy, [23:20] 
Indicates the support for T32 non flag-setting MOV instructions: 
@x1 Support for T32 instruction set encoding T1 of the MOV (register) instruction, copying 
from a low register to a low register. 
TabBranch, [19:16] 
Indicates the implemented Table Branch instructions in the T32 instruction set. 
@x1 The TBB and TBH instructions. 


SynchPrim, [15:12] 
Indicates the implemented Synchronization Primitive instructions. 
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B1 AArch32 system registers 
B1.77 Instruction Set Attribute Register 3 


@x2 e The LDREX and STREX instructions. 
e The CLREX, LDREXB, STREXB, and STREXH instructions. 
e The LDREXD and STREXD instructions. 


SVC, [11:8] 
Indicates the implemented SVC instructions: 


0x1 The SVC instruction. 
SIMD, [7:4] 
Indicates the implemented Single Instruction Multiple Data (SIMD) instructions. 


0x3 e The SSAT and USAT instructions, and the Q bit in the PSRs. 
e The PKHBT, PKHTB, QADD16, QADD8, QASX, QSUB16, QSUB8, QSAX, SADD16, SADD8, 
SASX, SEL, SHADD16, SHADD8, SHASX, SHSUB16, SHSUB8, SHSAX, SSAT16, SSUB16, 
SSUB8, SSAX, SXTAB16, SXTB16, UADD16, UADD8, UASX, UHADD16, UHADD8, UHASX, 
UHSUB16, UHSUB8, UHSAX, UQADD16, UQADD8, UQASX, UQSUB16, UQSUB8, UQSAX, 
USAD8, USADA8, USAT16, USUB16, USUB8, USAX, UXTAB16, UXTB16 instructions, and 
the GE[3:0] bits in the PSRs. 


Saturate, [3:0] 
Indicates the implemented Saturate instructions: 


ex1 The QADD, QDADD, QDSUB, QSUB and the Q bit in the PSRs. 


To access the ID_ISAR3: 
MRC p15, ©, <Rt>, c@, c2, 3 ; Read ID_ISAR3 into Rt 


Register access is encoded as follows: 


Table B1-60 ID_ISAR3 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000} 0010 | 011 
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B1 AArch32 system registers 
B1.78 Instruction Set Attribute Register 4 


B1.78 Instruction Set Attribute Register 4 
The ID_ISAR4 characteristics are: 


Purpose 

Provides information about the instruction sets implemented by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 





























Must be interpreted with ID_ISARO, ID_ISAR1, ID_ISAR2, ID_ISAR3, and ID_ISARS. See: 
e B1.74 Instruction Set Attribute Register 0 on page B1-258 
e B1.75 Instruction Set Attribute Register 1 on page B1-260 
e B1.76 Instruction Set Attribute Register 2 on page B1-262 
e B1.77 Instruction Set Attribute Register 3 on page B1-264 
¢ B1.79 Instruction Set Attribute Register 5 on page B1-268 


Configurations 
ID_ISAR4 is architecturally mapped to AArch64 register ID ISAR4 EL]. See B2.6/ AArch32 
Instruction Set Attribute Register 4, ELI on page B2-450. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_ISAR4 is a 32-bit register. 


31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 





SynchPrim_frac — 


Figure B1-33 ID_ISAR4 bit assignments 


SWP_ frac, [31:28] 
Indicates support for the memory system locking the bus for SWP or SWPB instructions: 


@x® SWP and SWPB instructions not implemented. 

PSR_M, [27:24] 
Indicates the implemented M profile instructions to modify the PSRs: 
exe None implemented. 

SynchPrim_frac, [23:20] 


This field is used with the ID_ISAR3.SynchPrim field to indicate the implemented 
Synchronization Primitive instructions: 


0x0 e The LDREX and STREX instructions. 
e The CLREX, LDREXB, LDREXH, STREXB, and STREXH instructions. 
e The LDREXD and STREXD instructions. 


Barrier, [19:16] 
Indicates the supported Barrier instructions in the A32 and T32 instruction sets: 


@x1 The DMB, DSB, and ISB barrier instructions. 


SMC, [15:12] 
Indicates the implemented SMC instructions: 
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B1 AArch32 system registers 
B1.78 Instruction Set Attribute Register 4 


@x1 The SMC instruction. 


Writeback, [11:8] 
Indicates the support for writeback addressing modes: 


ex1 Processor supports all of the writeback addressing modes defined in ARMV8. 


WithShifts, [7:4] 
Indicates the support for instructions with shifts: 


0x4 e Support for shifts of loads and stores over the range LSL 0-3. 
e Support for other constant shift options, both on load/store and other instructions. 
e Support for register-controlled shift options. 


Unpriv, [3:0] 
Indicates the implemented unprivileged instructions: 


@x2 ¢ The LDRBT, LDRT, STRBT, and STRT instructions. 
e The LDRHT, LDRSBT, LDRSHT, and STRHT instructions. 


To access the ID_ISAR4: 
MRC p15, @, <Rt>, c@, c2, 4 ; Read ID_ISAR4 into Rt 


Register access is encoded as follows: 


Table B1-61 ID_ISAR4 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0010 | 100 























ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-267 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.79 Instruction Set Attribute Register 5 


B1.79 Instruction Set Attribute Register 5 
The ID_ISARS characteristics are: 


Purpose 

Provides information about the instruction sets that the processor implements. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 





























ID_ISAR5 must be interpreted with ID_ISARO, ID_ISAR1, ID_ISAR2, ID_ISAR3, and 
ID_ISAR4. See: 

¢ B1.74 Instruction Set Attribute Register 0 on page B1-258 

¢ B1.75 Instruction Set Attribute Register 1 on page B1-260 

¢ B1.76 Instruction Set Attribute Register 2 on page B1-262 

¢ B1.77 Instruction Set Attribute Register 3 on page B1-264 

¢ B1.78 Instruction Set Attribute Register 4 on page B1-266 


Configurations 
ID_ISARS is architecturally mapped to AArch64 register ID ISARS_EL1. See B2.62 AArch32 
Instruction Set Attribute Register 5, ELI on page B2-452. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_ISARS is a 32-bit register. 


31 20 19 16 15 12 11 8 


7 4 3 0 


Figure B1-34 ID_ISARS5 bit assignments 


[31:20] 
Reserved, RESO. 
CRC32, [19:16] 
Indicates whether CRC32 instructions are implemented in AArch32 state: 


0x1 CRC32 instructions are implemented. 
SHA2, [15:12] 
Indicates whether SHA2 instructions are implemented in AArch32 state: 


exe Cryptographic Extensions are not implemented or are disabled. 
@x1 SHA256H, SHA256H2, SHA256SU@, and SHA256SU1 instructions are implemented. 


See the Cortex*-A35 Processor Cryptographic Extension Technical Reference Manual for more 
information. 


SHA1, [11:8] 
Indicates whether SHA1 instructions are implemented in AArch32 state: 


exe Cryptographic Extensions are not implemented or are disabled. 
@x1 SHA1C, SHA1P, SHA1M, SHA1H, SHA1SU@, and SHA1SU1 instructions are implemented. 


See the Cortex®-A35 Processor Cryptographic Extension Technical Reference Manual for more 
information. 
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B1 AArch32 system registers 
B1.79 Instruction Set Attribute Register 5 


AES, [7:4] 
Indicates whether AES instructions are implemented in AArch32 state: 
exe Cryptographic Extensions are not implemented or are disabled. 
@x2 AESE, AESD, AESMC and AESIMC, plus PMULL and PMULL2 instructions operating on 64- 
bit data. 


See the Cortex*-A35 Processor Cryptographic Extension Technical Reference Manual for more 
information. 


SEVL, [3:0] 
Indicates whether the SEVL instruction is implemented: 


ex1 SEVL implemented to send event local. 
To access the ID_ISARS: 
MRC p15,0,<Rt>,c@,c2,5 ; Read ID_ISAR5 into Rt 


Register access is encoded as follows: 


Table B1-62 ID_ISARS5 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0010 | 101 
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B1 AArch32 system registers 
B1.80 Memory Model Feature Register 0 


B1.80 Memory Model Feature Register 0 
The ID MMEFR0O characteristics are: 


Purpose 

Provides information about the memory model and memory management support in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 





























Must be interpreted with ID_MMFR1, ID_MMFR2, and ID_MMFR3. See: 
¢ B1.81 Memory Model Feature Register 1 on page B1-272 
¢ B1.82 Memory Model Feature Register 2 on page B1-274 
¢ B1.83 Memory Model Feature Register 3 on page B1-276 


Configurations 
ID_MMER0O is architecturally mapped to AArch64 register ID MMFRO_ELI. See 
B2.63 AArch32 Memory Model Feature Register 0, ELI on page B2-454. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_MMER0O is a 32-bit register. 


28 27 24 23 20 19 16 15 12 11 


FOSE } nseo | Tom | ShareLvi | outershr | pMsa | VMSA 


Figure B1-35 ID_MMFR0 bit assignments 


InnerShr, [31:28] 
Indicates the innermost shareability domain implemented: 


@x1 Implemented with hardware coherency support. 


FCSE, [27:24] 
Indicates support for Fast Context Switch Extension (FCSE): 


@xe Not supported. 


AuxReg, [23:20] 
Indicates support for Auxiliary registers: 


0x2 Support for Auxiliary Fault Status Registers (AIFSR and ADFSR) and Auxiliary 
Control Register. 


TCM, [19:16] 
Indicates support for TCMs and associated DMAs: 


@xe Not supported. 


ShareLvl, [15:12] 
Indicates the number of shareability levels implemented: 


@x1 Two levels of shareability implemented. 


OuterShr, [11:8] 
Indicates the outermost shareability domain implemented: 
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B1 AArch32 system registers 
B1.80 Memory Model Feature Register 0 


@x1 Implemented with hardware coherency support. 


PMSA, [7:4] 
Indicates support for a Protected Memory System Architecture (PMSA): 


@xe Not supported. 


VMSA, [3:0] 
Indicates support for a Virtual Memory System Architecture (VMSA). 


@x5 Support for: 
e VMSAv7, with support for remapping and the Access flag. 
e The PXN bit in the Short-descriptor translation table format descriptors. 
¢ The Long-descriptor translation table format. 


To access the ID_ MMFRO: 
MRC p15,0,<Rt>,c@,c1,4 ; Read ID_MMFR@ into Rt 
Register access is encoded as follows: 


Table B1-63 ID_MMFR0O access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0001 | 100 
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B1 AArch32 system registers 
B1.81 Memory Model Feature Register 1 


B1.81 Memory Model Feature Register 1 
The ID MMFRI characteristics are: 


Purpose 

Provides information about the memory model and memory management support in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 





























Must be interpreted with ID_MMFRO, ID_MMFR2, and ID_MMFR3. See: 
¢ B1.80 Memory Model Feature Register 0 on page B1-270 
e B1.82 Memory Model Feature Register 2 on page B1-274 
e B1.83 Memory Model Feature Register 3 on page B1-276 


Configurations 
ID_MMER1 is architecturally mapped to AArch64 register ID MMFR1_ ELI. See 
B2.64 AArch32 Memory Model Feature Register 1, ELI on page B2-456. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_MMER1 is a 32-bit register. 


28 27 2423 20 19 1615 12 11 


L1TstCin L1Hvd L1UnisW | L1HvdSW | L1UniVA | L1HvdVA 


Figure B1-36 ID_MMFR1 bit assignments 


BPred, [31:28] 
Indicates branch predictor management requirements: 


0x4 For execution correctness, branch predictor requires no flushing at any time. 


L1TstCln, [27:24] 
Indicates the supported L1 Data cache test and clean operations, for Harvard or unified cache 
implementation: 


@xe None supported. 


L1Uni, [23:20] 
Indicates the supported entire L1 cache maintenance operations, for a unified cache 
implementation: 


@xe None supported. 
L1Hvd, [19:16] 


Indicates the supported entire L1 cache maintenance operations, for a Harvard cache 
implementation: 


@xe None supported. 


L1UniSW, [15:12] 
Indicates the supported L1 cache line maintenance operations by set/way, for a unified cache 
implementation: 


@xe None supported. 
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L1HvdSW, [11:8] 
Indicates the supported L1 cache line maintenance operations by set/way, for a Harvard cache 
implementation: 


exe None supported. 


L1UniVA, [7:4] 
Indicates the supported L1 cache line maintenance operations by MVA, for a unified cache 
implementation: 


@xe None supported. 


L1HvdVA, [3:0] 
Indicates the supported L1 cache line maintenance operations by MVA, for a Harvard cache 
implementation: 


exe None supported. 
To access the ID MMFRI1: 
MRC p15, ©, <Rt>, c@, c1, 5; Read ID_MMFR1 into Rt 


Register access is encoded as follows: 


Table B1-64 ID_MMFR1 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0001 | 101 
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B1.82 Memory Model Feature Register 2 
The ID_ MMEFR2 characteristics are: 


Purpose 
Provides information about the implemented memory model and memory management support 
in AArch32. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO |RO |RO RO 





























Must be interpreted with ID MMFRO, ID MMFRI1, and ID MMER3. See: 
¢ B1.80 Memory Model Feature Register 0 on page B1-270 
e B1.81 Memory Model Feature Register 1 on page B1-272 
e B1.83 Memory Model Feature Register 3 on page B1-276 


Configurations 
ID_MMER2 is architecturally mapped to AArch64 register ID MMFR2_ ELI. See 
B2.65 AArch32 Memory Model Feature Register 2, EL] on page B2-458. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_MMER2 is a 32-bit register. 


28 27 24 23 20 19 1615 12 11 


HWAccFlg | WFIStall UniTLB HvdTLB |LL1HvdRng| L1HvdBG | L1HvdFG 


Figure B1-37 ID_MMFR2 bit assignments 


HWaAccFig, [31:28] 
Hardware Access Flag. Indicates support for a Hardware Access flag, as part of the VMSAv7 
implementation: 


exe Not supported. 


WF'IStall, [27:24] 
Wait For Interrupt Stall. Indicates the support for Wait For Interrupt (WFI) stalling: 


0x1 Support for WFI stalling. 


MemBarr, [23:20] 
Memory Barrier. Indicates the supported CP15 memory barrier operations. 


0x2 Supported CP15 memory barrier operations are: 
¢ Data Synchronization Barrier (DSB). 
e Instruction Synchronization Barrier (ISB). 
e Data Memory Barrier (DMB). 


UniTLB, [19:16] 
Unified TLB. Indicates the supported TLB maintenance operations, for a unified TLB 
implementation. 
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0x6 Supported unified TLB maintenance operations are: 

e Invalidate all entries in the TLB. 

¢ Invalidate TLB entry by MVA. 

¢ Invalidate TLB entries by ASID match. 

e Invalidate instruction TLB and data TLB entries by MVA All ASID. This is a 
shared unified TLB operation. 

¢ Invalidate Hyp mode unified TLB entry by MVA. 

e Invalidate entire Non-secure EL1 and ELO unified TLB. 

e Invalidate entire Hyp mode unified TLB. 

e TLBIMVALIS, TLBIMVAALIS, TLBIMVALHIS, TLBIMVAL, TLBIMVAAL, and TLBIMVALH. 

e TLBIIPAS2IS, TLBIIPAS2LIS, TLBIIPAS2, and TLBIIPAS2L. 


HvdTLB, [15:12] 
Harvard TLB. Indicates the supported TLB maintenance operations, for a Harvard TLB 
implementation: 


exe Not supported. 


LL1HvdRng, [11:8] 
L1 Harvard cache Range. Indicates the supported L1 cache maintenance range operations, for a 
Harvard cache implementation: 


exe Not supported. 


L1HvdBG, [7:4] 
L1 Harvard cache Background fetch. Indicates the supported L1 cache background prefetch 
operations, for a Harvard cache implementation: 


exe Not supported. 


L1HvdFG, [3:0] 
L1 Harvard cache Foreground fetch. Indicates the supported L1 cache foreground prefetch 
operations, for a Harvard cache implementation: 


@xe Not supported. 


To access the ID_ MMFR2: 


MRC p15,0,<Rt>,c@,c1,6 ; Read ID_MMFR2 into Rt 


Register access is encoded as follows: 


Table B1-65 ID_MMFR2 access encoding 





coproc | opc1 | CRn | CRm | opc2 




















1111 000 |0000 |0001 |110 
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B1.83 Memory Model Feature Register 3 
The ID_ MMEFR3 characteristics are: 


Purpose 

Provides information about the memory model and memory management support in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 





























Must be interpreted with ID_MMFRO, ID MMFRI1, and ID_MMFR2. See: 
¢ B1.80 Memory Model Feature Register 0 on page B1-270 
e B1.81 Memory Model Feature Register 1 on page B1-272 
e B1.82 Memory Model Feature Register 2 on page B1-274 


Configurations 
ID_MMER3 is architecturally mapped to AArch64 register ID MMFR3_ ELI. See 
B2.66 AArch32 Memory Model Feature Register 3, ELI on page B2-460. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_MMEFR3 is a 32-bit register. 


31 28 27 24 23 20 19 1615 12 11 8 7 4 3 0 





Figure B1-38 ID_MMFR3 bit assignments 


Supersec, [31:28] 
Supersections. Indicates support for supersections: 


exe Supersections supported. 


CMemsSz, [27:24] 
Cached Memory Size. Indicates the size of physical memory supported by the processor caches: 


0x2 1TByte, corresponding to a 40-bit physical address range. 


CohWalk, [23:20] 
Coherent walk. Indicates whether translation table updates require a clean to the point of 
unification: 


0x1 Updates to the translation tables do not require a clean to the point of unification to 
ensure visibility by subsequent translation table walks. 


[19:16] 
Reserved, RESO. 

MaintBest, [15:12] 
Maintenance broadcast. Indicates whether cache, TLB and branch predictor operations are 
broadcast: 


0x2 Cache, TLB and branch predictor operations affect structures according to shareability 
and defined behavior of instructions. 


BPMaint, [11:8] 
Branch predictor maintenance. Indicates the supported branch predictor maintenance operations. 
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0x2 Supported branch predictor maintenance operations are: 


e Invalidate all branch predictors. 
e Invalidate branch predictors by MVA. 


CMaintSW, [7:4] 
Cache maintenance by set/way. Indicates the supported cache maintenance operations by set/ 
way. 
0x1 Supported hierarchical cache maintenance operations by set/way are: 


e Invalidate data cache by set/way. 
e Clean data cache by set/way. 
e Clean and invalidate data cache by set/way. 


CMaintVA, [3:0] 
Cache maintenance by MVA. Indicates the supported cache maintenance operations by MVA. 


0x1 Supported hierarchical cache maintenance operations by MVA are: 
e Invalidate data cache by MVA. 


Invalidate data cache by MVA operations are treated as clean and invalidate data 
cache by MVA operations on the executing core. If the operation is broadcast to 
another core then it is broadcast as an invalidate data cache by MVA operation. 

e Clean data cache by MVA. 

e Clean and invalidate data cache by MVA. 

e Invalidate instruction cache by MVA. 

e Invalidate all instruction cache entries. 


To access the ID_MMFR3: 
MRC p15, ©, <Rt>, c@, c1, 7; Read ID_MMFR3 into Rt 


Register access is encoded as follows: 


Table B1-66 ID_MMFR3 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000} 0001 | 111 
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Processor Feature Register 0 


The ID_PFRO characteristics are: 


Purpose 

Gives top-level information about the instruction sets supported by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- [RO |RO ÍRO IRO RO 





























ID_PFRO must be interpreted with ID_PFR1. 


Configurations 
ID_PFR0O is architecturally mapped to AArch64 register ID PFRO_EL1. See B2.67 AArch32 
Processor Feature Register 0, ELI on page B2-462. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_PFR0O is a 32-bit register. 


31 16 15 12 11 8 


7 4 3 0 


Figure B1-39 ID_PFRO bit assignments 


[31:16] 
Reserved, RESO. 
State3, [15:12] 
Indicates support for Thumb Execution Environment (T32EE) instruction set. This value is: 


exe Processor does not support the T32EE instruction set. 


State2, [11:8] 
Indicates support for Jazelle. This value is: 


0x1 Processor supports trivial implementation of Jazelle. 


State1, [7:4] 
Indicates support for T32 instruction set. This value is: 


0x3 Processor supports T32 encoding after the introduction of Thumb-2 technology, and 
for all 16-bit and 32-bit T32 basic instructions. 


State0, [3:0] 
Indicates support for A32 instruction set. This value is: 


0x1 A32 instruction set implemented. 


To access the ID_PFRO: 


MRC p15,0,<Rt>,c@,c1,@ ; Read ID_PFR@ into Rt 


Register access is encoded as follows: 
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Table B1-67 ID_PFRO access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0000 | 0001 | 000 
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B1.85 Processor Feature Register 1 
The ID_PFRI characteristics are: 


Purpose 
Provides information about the programmers model and architecture extensions supported by 
the processor. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO |RO |RO RO 





























Must be interpreted with ID_PFRO. 


Configurations 
ID_PFR1 is architecturally mapped to AArch64 register ID PFR1_EL1. See B2.68 AArch32 


Processor Feature Register 1, ELI on page B2-463. 
There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ID_PFR1 is a 32-bit register. 


31 28 27 24 23 20 19 16 15 12 11 8 


7 4 3 0 


Virtualization — 
Figure B1-40 ID_PFR1 bit assignments 


GIC CPU, [31:28] 
GIC CPU support: 


@x® GIC CPU interface is disabled, GICCDISABLE is HIGH, or not implemented. 

0x1 GIC CPU interface is implemented and enabled, GICCDISABLE is LOW. 
[27:20] 

Reserved, RAZ. 


GenTimer, [19:16] 
Generic Timer support: 


0x1 Generic Timer implemented. 


Virtualization, [15:12] 
Indicates support for Virtualization: 
0x1 Virtualization implemented. 
MProgMod, [11:8] 
M profile programmers model support: 
@xe Not supported. 
Security, [7:4] 
Security support: 
0x1 Security implemented. This includes support for Monitor mode and the SMC 


instruction. 


ProgMod, [3:0] 
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Model must support User, FIQ, IRQ, Supervisor, Abort, Undefined and System modes: 


@x1 Supported. 
To access the ID_PFR1: 
MRC p15,0,<Rt>,c@,c1,1 ; Read ID_PFR1 into Rt 


Register access is encoded as follows: 


Table B1-68 ID_PFR1 access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0000} 0001 | 001 
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B1.86 Instruction Fault Address Register 
The IFAR characteristics are: 


Purpose 
Holds the virtual address of the faulting address that caused a synchronous Prefetch Abort 
exception. 

Usage constraints 
This register is accessible as follows: 











ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 

(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
IFAR(S) | - a g RW |- l- RW 
IFAR(NS) | - - RW |- RW | RW - 





























Configurations 
IFAR (NS) is architecturally mapped to AArch64 register FAR_EL1[63:32]. See B2.44 Fault 
Address Register, EL] on page B2-417. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


IFAR (S) is architecturally mapped to AArch32 register HIFAR. See B/.65 Hyp Instruction 
Fault Address Register on page B1-242. 


IFAR (S) is architecturally mapped to AArch64 register FAR_EL2[63:32]. See B2.45 Fault 
Address Register, EL2 on page B2-418. 


Attributes 
IFAR is a 32-bit register. 


31 0 


VA of faulting address of synchronous Prefetch Abort exception 


Figure B1-41 IFAR bit assignments 


VA, [31:0] 
The Virtual Address of faulting address of synchronous Prefetch Abort exception. 


To access the IFAR: 


MRC p15, ©, <Rt>, c6, c@, 2; Read IFAR into Rt 
MCR p15, ©, <Rt>, c6, c@, 2; Write Rt to IFAR 
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Purpose 


Holds status information about the last instruction fault. 


Usage constraints 
This register is accessible as follows: 


B1 AArch32 system registers 
B1.87 Instruction Fault Status Register 


























ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 











Configurations 


IFSR (NS) is architecturally mapped to AArch64 register IFSR32_EL2. See B2.69 Instruction 


Fault Status Register, EL2 on page B2-465. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Attributes 
IFSR is a 32-bit register. 


There are two formats for this register. The current translation table format determines which format of 


the register is used. 
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B1.88 IFSR with Short-descriptor translation table format 


IFSR has a specific format when using the Short-descriptor translation table format. 


The following figure shows the IFSR bit assignments when using the Short-descriptor translation table 


format. 
31 131211109 8 4.3 0 
ExT — L_Fgsj4] 
RESO 
Figure B1-42 IFSR bit assignments for Short-descriptor translation table format 
[31:13] 
Reserved, RESO. 
ExT,[12] 
External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 
(2) External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 


[11] 
Reserved, RESO. 
FS[4],[10] 
Part of the Fault Status field. See bits [3:0]. 
[9] 
RAZ. 
[8:5] 
Reserved, RESO. 
FS[3:0], [4:0] 
Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is 
reserved. 
@beee1e Debug event. 
@beee11 Access flag fault, section. 
@bee1e1 Translation fault, section. 
@bee11@ Access flag fault, page. 
@be0111 Translation fault, page. 
@be1eee@ Synchronous external abort, non-translation. 
Əb01001 Domain fault, section. 
@be@1011 Domain fault, page. 
@b@110@ Synchronous external abort on translation table walk, first level. 
@be1101 Permission Fault, Section. 
@b@111@ Synchronous external abort on translation table walk, second Level. 
@b@1111 Permission fault, page. 
0b10009 TLB conflict abort. 
@b11001 Synchronous parity error on memory access. 
@b1110@ Synchronous parity error on translation table walk, first level. 
@b1111@ Synchronous parity error on translation table walk, second level. 
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B1.89 IFSR with Long-descriptor translation table format 
IFSR has a specific format when using the Long-descriptor translation table format. 


The following figure shows the IFSR bit assignments when using the Long-descriptor translation table 


format. 
31 131211109 8 6 5 0 
| ffs] so e | 
L_ ExT 
Figure B1-43 IFSR bit assignments for Long-descriptor translation table format 
[31:13] 
Reserved, RESO. 
ExT,[12] 
External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 
(7) External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 


[11:10] 
Reserved, RESO. 
[9] 
RAO. 
[8:6] 
Reserved, RESO. 
Status,[5:0] 
Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is 
reserved. 
@beeeeee Address size fault in TTBRO or TTBRI. 
@b@G01LL Translation fault, LL bits indicate level. 
@b@@1ELL Access fault flag, LL bits indicate level. 
@b@011LL Permission fault, LL bits indicate level. 
@be1eeee Synchronous external abort. 
@b@101LL Synchronous external abort on translation table walk, LL bits indicate level. 
@b@110ee Synchronous parity error on memory access. 


@b@111LL Synchronous parity error on memory access on translation table walk, LL bits 
indicate level. 


0b100001 Alignment fault. 
@b100018 Debug event. 
0b110000 TLB conflict abort. 


Table B1-69 Encodings of LL bits associated with the MMU fault 





Bits | Meaning 





@beO | Reserved 














Qb@1 | Level 1 
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Table B1-69 Encodings of LL bits associated with the MMU {ault (continued) 





Bits | Meaning 





@b10 | Level 2 











0b11 | Level 3 








If a Data Abort exception is generated by an instruction cache maintenance operation when the Long- 
descriptor translation table format is selected, the fault is reported as a Cache Maintenance fault in the 
DFSR or HSR with the appropriate Fault Status code. For such exceptions reported in the DFSR, the 


corresponding IFSR is UNKNOWN. 
To access the IFSR: 


MRC p15, ©, <Rt>, c5, c@, 1; Read IFSR into Rt 
MCR p15, ©, <Rt>, c5, c@, 1; Write Rt to IFSR 


Register access is encoded as follows: 


Table B1-70 IFSR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0101 |0000 | 001 
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B1.90 Interrupt Status Register 
The ISR characteristics are: 


Purpose 
Shows whether an IRQ, FIQ, or external abort is pending. An indicated pending abort might be 
a physical abort or a virtual abort. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO |RO |RO RO 





























Configurations 
ISR is architecturally mapped to AArch64 register ISR_EL1. See B2.72 Interrupt Status 
Register, ELI on page B2-469. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
ISR is a 32-bit register. 


31 98765 0 


me 


Figure B1-44 ISR bit assignments 


[31:9] 
Reserved, RESO. 
A, [8] 
External abort pending bit: 
© No pending external abort. 
1 An external abort is pending. 
1, [7] 
IRQ pending bit. Indicates whether an IRQ interrupt is pending: 
@ No pending IRQ. 
1 An IRQ interrupt is pending. 
F, [6] 
FIQ pending bit. Indicates whether an FIQ interrupt is pending: 
@ No pending FIQ. 
1 An FIQ interrupt is pending. 
[5:0] 
Reserved, RESO. 
To access the ISR: 


MRC p15, ©, <Rt>, c12, c1, 1; Read ISR into Rt 


Register access is encoded as follows: 





ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-287 
reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.90 Interrupt Status Register 


Table B1-71 ISR access encoding 





coproc | opc1 | CRn | CRm | opc2 




















1111 000 | 1100 | 0001 | 000 
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B1.91 L2 Auxiliary Control Register 
The L2ZACTLR characteristics are: 


Purpose 


Provides configuration and control options for the L2 memory system. 
Usage constraints 


This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























You can write to this register only when the L2 memory system is idle. ARM recommends that 
you write to this register after a powerup reset before the MMU is enabled and before any AXI, 
ACE, CHI, or ACP traffic has begun. 


If the register must be modified after a powerup reset sequence, to idle the L2 memory system, 
you must take the following steps: 


1. Disable the MMU from each core followed by an ISB to ensure the MMU disable operation 
is complete, then followed by a DSB to drain previous memory transactions. 


2. Ensure that the system has no outstanding AC channel coherence requests to the Cortex-A35 
processor. 


3. Ensure that the system has no outstanding ACP requests to the Cortex-A35 processor. 


When the L2 is idle, the processor can update the LZACTLR followed by an ISB. After the 

L2ACTLR is updated, the MMUs can be enabled and normal ACE and ACP traffic can resume. 
Configurations 

There is one copy of this register that is used in both Secure and Non-secure states. 


L2ACTLR is mapped to the AArch64 LZACTLR_ELI register. See B2.73 L2 Auxiliary Control 
Register, EL] on page B2-470. 


Attributes 
L2ACTLR is a 32-bit register. 


31 30 29 28 25 24 15 14 13 4 3 2 0 


ai RESO i RESO il RESO i 


f Ep lee 


L2 Victim Control 
Enable UniqueClean evictions with data 
Disable clean/evict push to external 


Figure B1-45 L2ACTLR bit assignments 
[31:30] 
L2 Victim Control. 


@b1@ This is the default value. Software must not change it. 


L2DEIEN, [29] 
L2 cache data RAM error injection enable. The possible values are: 
@ Normal behavior, errors are not injected. This is the reset value. 
1 Double-bit errors are injected on all writes to the L2 cache data RAMs. 
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[28:25] 
Reserved, RESO. 
L2TEIEN, [24] 
L2 cache tag RAM error injection enable. The possible values are: 


© Normal behavior, errors are not injected. This is the reset value. 


1 Double-bit errors are injected on all writes to the L2 cache tag RAMs. 


[23:15] 
Reserved, RESO. 
Enable UniqueClean evictions with data, [14] 
Enables UniqueClean evictions with data. The possible values are: 


@ Disables UniqueClean evictions with data. This is the reset value for ACE. 
1 Enables UniqueClean evictions with data. This is the reset value for CHI. 
In AXI implementations, this field is REso. 


[13:4] 
Reserved, RESO. 
Disable clean/evict push to external, [3] 
Disables clean/evict push to external. The possible values are: 


© Enables clean/evict to be pushed out to external. This is the reset value for ACE. 
1 Disables clean/evict from being pushed to external. This is the reset value for CHI. 


In AXI implementations, this field is REs1. 


[2:0] 
Reserved, RESO. 


To access the LZACTLR: 


MRC p15, 1, <Rt>, c15, c@, @; Read L2ACTLR into Rt 
MCR p15, 1, <Rt>, c15, c@, @; Write Rt to L2ACTLR 


Register access is encoded as follows: 


Table B1-72 L2ACTLR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 001 | 1111 | 0000 | 000 
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B1.92 L2 Control Register 
The L2CTLR characteristics are: 


Purpose 

Provides IMPLEMENTATION DEFINED control options for the L2 memory system. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- [RW {Rw IRW [RW RW 





























L2CTLR is writable. However, all writes to this register are ignored. 


Configurations 
L2CTLR is mapped to the AArch64 L2CTLR_EL1 register. See B2.74 L2 Control Register, ELI 
on page B2-472. 
There is one L2CTLR for the Cortex-A35 processor. 


There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes 
L2CTLR is a 32-bit register. 


26 25 24 23 22 21 20 6 5 4 


Number of eee | | L2 Data RAM input latency! 
| SCU- L2 Cache Protection Reserved 
CPU Cache Protection 


L2 Data RAM output latency 
Figure B1-46 L2CTLR bit assignments 

[31:26] 

Reserved, RESO. 
Number of cores, [25:24] 

Number of cores present: 

@bee@ One core, core 0. 

@b@1 Two cores, core 0 and core 1. 

@b1@ Three cores, cores 0 to 2. 

@b11 Four cores, cores 0 to 3. 


These bits are read-only and the value of this field is set to the number of cores present in the 
configuration. 


[23] 
Reserved, RAZ. 
CPU Cache Protection, [22] 
CPU Cache Protection. Core RAMs are implemented: 


e Without ECC. 
al With ECC. 
This field is RO. 


SCU-L2 Cache Protection, [21] 
SCU-L2 Cache Protection. L2 cache is implemented: 
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(3 Without ECC. 
1 With ECC. 
This field is RO. 


[20:6] 
Reserved, RAZ. 

L2 Data RAM input latency, [5] 
L2 data RAM input latency 


(3 l-cycle input delay from L2 data RAMs. 
1 2-cycle input delay from L2 data RAMs. 
This field is RO. 


[4:1] 
Reserved, RAZ. 

L2 Data RAM output latency, [0] 
L2 data RAM output latency: 


(3 2-cycle output delay from L2 data RAMs. 
1 3-cycle output delay from L2 data RAMs. 


This field is RO. 
To access the L2CTLR: 


MRC p15, 1, <Rt>, c9, c@, 2; Read L2CTLR into Rt 


Register access is encoded as follows: 


Table B1-73 L2CTLR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 001 |1001 |0000 |010 
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B1.93 L2 Extended Control Register 
The L2ECTLR characteristics are: 


Purpose 
Provides additional IMPLEMENTATION DEFINED control options for the L2 memory system. This 
register is used for dynamically changing, but implementation specific, control bits. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























The L2ECTLR can be written dynamically. 


Configurations 
L2ECTLR is mapped to the AArch64 L2ECTLR_ELI register. See 82.75 L2 Extended Control 
Register, EL] on page B2-474. 


There is one copy of this register that is used in both Secure and Non-secure states. 
There is one LZECTLR for the Cortex-A35 processor. 


Attributes 
L2ECTLR is a 32-bit register. 


31 30 29 28 3210 
LAXI, ACE, or CHI asynchronous error L2 dynamic retention control- 
L2 internal asynchronous error 
RESO 


Figure B1-47 L2ECTLR bit assignments 


[31] 
Reserved, RESO. 
L2 internal asynchronous error, [30] 
L2 internal asynchronous error caused by L2 RAM double-bit ECC error. The possible values 


are: 
(3 No pending asynchronous error. This is the reset value. 
1 An asynchronous error has occurred. 


A write of 0 clears this bit. A write of 1 is ignored. 


AXI, ACE, or CHI asynchronous error, [29] 
AXI, ACE, or CHI asynchronous error indication. The possible values are: 
(3 No pending asynchronous error. 


1 An asynchronous error has occurred. 


A write of 0 clears this bit. A write of 1 is ignored. 


[28:3] 
Reserved, RESO. 
L2 dynamic retention control, [2:0] 
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L2 dynamic retention control. The possible values are: 


@beee L2 dynamic retention disabled. This is the reset value. 
@bee1 2 Generic Timer ticks required before retention entry. 
@be1@ 8 Generic Timer ticks required before retention entry. 
@b@11 32 Generic Timer ticks required before retention entry. 
0b100 64 Generic Timer ticks required before retention entry. 
@b101 128 Generic Timer ticks required before retention entry. 
@b11@ 256 Generic Timer ticks required before retention entry. 
@b111 512 Generic Timer ticks required before retention entry. 
To access the LZECTLR: 


MRC p15, 1, <Rt>, c9, c@, 3; Read L2ECTLR into Rt 
MCR p15, 1, <Rt>, c9, c0, 3; Write Rt to L2ECTLR 


Register access is encoded as follows: 


B1 AArch32 system registers 
B1.93 L2 Extended Control Register 


Table B1-74 L2ECTLR access encoding 





coproc 


opc1 


CRn | CRm 


opc2 





1111 








001 





1001 | 0000 





oll 
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B1.94 L2 Memory Error Syndrome Register 
The LZMERRSR characteristics are: 


Purpose 
Holds ECC errors on the: 
e L2 data RAMs. 
e L2 tag RAMs. 
e SCU snoop filter RAMs. 


Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW |RW | RW RW 


























Configurations 
The L2MERRSR is mapped to the AArch64 LZMERRSR_ ELI register. See B2.76 L2 Memory 
Error Syndrome Register, ELI on page B2-476. 





There is one copy of this register that is used in both Secure and Non-secure states. 


A write of any value to the register updates the register to 0x8000000000000000. 







Attributes 
L2MERRSR is a a 64-bit register. 
63 62 48 47 40 39 32 31 30 24 23 22 21181716 32 0 
| RESO Other errot || Repeat error RAMID re | RAM address a 
count count 
L— Fatal Valid — CPUID/Way — L— Res0 


Figure B1-48 L2MERRSR bit assignments 


Fatal, [63] 
Fatal bit. This bit is set to 1 on the first memory error that caused a data abort. It is a sticky bit 
so that after it is set, it remains set until the register is written. 


The reset value is 0. 


[62:48] 
Reserved, RESO. 

Other error count, [47:40] 
This field is set to 0 on the first memory error and is incremented on any memory error that does 
not match the RAMID and Bank/Way information in this register while the sticky Valid bit is 
set. 


The reset value is 0. 


Repeat error count, [39:32] 
This field is set to 0 on the first memory error and is incremented on any memory error that 
exactly matches the RAMID and Bank/Way information in this register while the sticky Valid 
bit is set. 


The reset value is 0. 
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Valid, [31] 
Valid bit. This bit is set to 1 on the first memory error. It is a sticky bit so that after it is set, it 
remains set until the register is written. 


The reset value is 0. 


RAMID, [30:24] 
RAM Identifier. Indicates the RAM in which the first memory error occurred. The possible 
values are: 
0x10 L2 tag RAM. 
@x11 L2 data RAM. 
0x12 SCU snoop filter RAM. 


[23:22] 
Reserved, RESO. 
CPUID/Way, [21:18] 
Indicates the RAM where the first memory error occurred. 


L2 tag RAM 
@x® Way 0 
@x1 Way 1 
@x6 Way 6 
0x7 Way 7 

L2 data RAM 
@x® Bank 0 
@x1 Bank 1 
@x7 Bank 7 
@x8-e@x Unused 
F 

SCU snoop filter RAM 


@x® CPU0:Way0 
0x1 CPU0:Way1 


@xE CPU3:Way2 
@xF CPU3:Way3 


[17] 

Reserved, RESO. 
RAM Address, [16:3] 

Indicates the index address of the first memory error. 
[2:0] 

Reserved, RESO. 


e A fatal error results in the RAMID, CPU ID/Way and RAM address recording the fatal error, even if 
the sticky bit was set. 

¢ Iftwo or more memory errors in the same RAM occur in the same cycle, only one error is reported. 

¢ Iftwo or more first memory error events from different RAMs occur in the same cycle, one of the 
errors is selected arbitrarily, while the Other error count field is incremented only by one. 

e Iftwo or more memory error events from different RAMs, that do not match the RAMID, bank, way, 
or index information in this register while the sticky Valid bit is set, occur in the same cycle, the 
Other error count field is incremented only by one. 
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To access the L2MERRSR: 


MRRC p15, 3, <Rt>, <Rt2>, c15; Read L2MERRSR into Rt and Rt2 
MCRR p15, 3, <Rt>, <Rt2>, c15; Write Rt and Rt2 to L2MERRSR 


Register access is encoded as follows: 


Table B1-75 L2MERRSR access encoding 





coproc | opc1 | CRm 





1111 0011 |1111 
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B1.95 Memory Attribute Indirection Registers 0 and 1 
The MAIRO and MAIRI1 characteristics are: 


Purpose 


To provide the memory attribute encodings corresponding to the possible AttrIndx values in a 
Long-descriptor format translation table entry for stage 1 translations. 

Usage constraints 
These registers are accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW |RW | RW RW 





























Accessible only when using the Long-descriptor translation table format. When using the Short- 
descriptor format see, instead, B/./0/ Primary Region Remap Register on page B1-310 and 
B1.99 Normal Memory Remap Register on page B1-307. 


AttrIndx[2], from the translation table descriptor, selects the appropriate MAIR: setting 
AttrIndx[2] to 0 selects MAIRO. 


The Secure instance of the register gives the value for memory accesses from Secure state. 


The Non-secure instance of the register gives the value for memory accesses from Non-secure 
states other than Hyp mode. 


Configurations 
MAIRO (NS) is architecturally mapped to AArch64 register MAIR_EL1[31:0] when 
TTBCR.EAE==1. See B2.77 Memory Attribute Indirection Register, EL] on page B2-479. 


MAIRO (S) is mapped to AArch64 register MAIR_EL3[31:0] when TTBCR.EAE==1. See 
B2.79 Memory Attribute Indirection Register, EL3 on page B2-482. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Attributes 
MAIRO is a 32-bit register when TTBCR.EAE==1. 


31 24 23 16 15 8 7 0 
MAIRO Attr3 Attr2 Attr1 AttrO 
MAIR1 Attr7 Attr6 Attr5 Attr4 


Figure B1-49 MAIRO and MAIR1 bit assignments 





Attrm, [7:0] 
Where m is 0-7. 
The memory attribute encoding for an AttrIndx[2:0] entry in a Long descriptor format 
translation table entry, where: 
e AttrIndx[2] selects the appropriate MAIR: 
— Setting AttrIndx[2] to 0 selects MAIRO. 
— Setting AttrIndx[2] to 1 selects MAIRI. 
e AttrIndx[2:0] gives the value of <n> in Attr<n>. 
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Table B1-76 Attr<n>[7:4] bit assignments 





Bits Meaning 





ebeeee Device memory. See Attr<n>/[3:0] bit assignments on page B1-299 for the type of Device memory. 





ObOORW, RW not 00 | Normal Memory, Outer Write-through transient. 


The transient hint is ignored. 





0be100 Normal Memory, Outer Non-Cacheable. 





@bO1RW, RW not 0O | Normal Memory, Outer Write-back transient. 


The transient hint is ignored. 





@b10RW Normal Memory, Outer Write-through non-transient. 














@b11RW Normal Memory, Outer Write-back non-transient. 














The following table shows the Attr<n>[3:0] bit assignments. The encoding of Attr<n>[3:0] depends on 
the value of Attr<n>[7:4]. 


Table B1-77 Attr<n>[3:0] bit assignments 





























Bits Meaning when Attr<n>[7:4] is 0000 | Meaning when Attr<n>[7:4] is not 0000 

ebeeee Device-nGnRnE memory UNPREDICTABLE 

ObOORW, RW not GO | UNPREDICTABLE Normal Memory, Inner Write-through transient 

0b0100 Device-nGnRE memory Normal memory, Inner Non-Cacheable 

@bO1RW, RW not OO | UNPREDICTABLE Normal Memory, Inner Write-back transient 

0b1000 Device-nGRE memory Normal Memory, Inner Write-through non-transient (RW=00) 
@b1ORW, RW not 0O | UNPREDICTABLE Normal Memory, Inner Write-through non-transient 

0b1100 Device-GRE memory Normal Memory, Inner Write-back non-transient (RW=00) 
Ob11RW, RW not 00O | UNPREDICTABLE Normal Memory, Inner Write-back non-transient 


























The following table shows the encoding of the R and W bits that are used, in some Attr<n> encodings in 
Table Bl-76 Attr<n>[7:4] bit assignments on page B1-299 and Table B1-77 Attr<n>[3:0] bit 
assignments on page B1-299, to define the read-allocate and write-allocate policies: 


Table B1-78 Encoding of R and W bits in some Attrm fields 





R or W | Meaning 























0 Do not allocate 
1 Allocate 
To access the MAIRO: 
MRC p15, ©, <Rt>, c10, c2, @ 3 Read MAIR@ into Rt 
MCR p15, ©, <Rt>, c10, c2, 0 5 Write Rt to MAIRO 
Register access is encoded as follows: 
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To access the MAIRI: 


MRC p15, ©, <Rt>, c10, c2, 1 3 Read MAIR1 into Rt 
MCR p15, ©, <Rt>, c10, c2, 1 ; Write Rt to MAIR1 


Register access is encoded as follows: 


B1 AArch32 system registers 
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Table B1-79 MAIRO access encoding 





coproc 


opc1 


CRn | CRm 


opc2 








1111 





000 





1010 | 0010 








000 





Table B1-80 MAIR1 access encoding 





coproc 


opc1 


CRn | CRm 


opc2 





1111 








000 





1010 | 0010 





001 











ARM 100236_0002_00_en 


Copyright © 2015-2017 ARM Limited or its affiliates. All rights 


reserved. 
Non-Confidential 


B1-300 


B1 AArch32 system registers 
B1.96 Main ID Register 


Main ID Register 


The MIDR characteristics are: 


Purpose 
Provides identification information for the processor, including an implementer code for the 
device and a device ID number. 

Usage constraints 
This register is accessible as follows: 



































ELO | ELO)|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 
Configurations 
MIDR is: 


e Architecturally mapped to the AArch64 MIDR_ ELI register. See B2.83 Main ID Register, 
EL1 on page B2-492. 
e Architecturally mapped to external MIDR_EL1 register. 


Attributes 
MIDR is a 32-bit register. 


31 24 23 20 19 1615 4 3 0 


Figure B1-50 MIDR bit assignments 


Implementer, [31:24] 
Indicates the implementer code. This value is: 


ex41 ARM. 


Variant, [23:20] 
Indicates the variant number of the processor. This is the major revision number n in the rn part 
of the rnpn description of the product revision status. This value is: 


@x® r0p2. 


Architecture, [19:16] 
Indicates the architecture code. This value is: 


OxF Defined in the CPUID scheme. 


PartNum, [15:4] 
Indicates the primary part number. This value is: 


@xD@4 Cortex-A35 processor. 


Revision, [3:0] 
Indicates the minor revision number of the processor. This is the minor revision number n in the 
pn part of the rnpn description of the product revision status. This value is: 


@x2 r0p2. 
To access the MIDR: 
MRC p15, ©, <Rt>, c@, c@, @; Read MIDR into Rt 


Register access is encoded as follows: 
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Table B1-81 MIDR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0000 | 0000 | 000 
The MIDR can be accessed through the external debug interface, offset @xDee. 
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B1.97 Multiprocessor Affinity Register 
The MPIDR characteristics are: 


Purpose 
Provides an additional core identification mechanism for scheduling purposes in a cluster. 


EDDEVAFFO is a read-only copy of MPIDR accessible from the external debug interface. 


Usage constraints 
This register is accessible as follows: 



































ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 
Configurations 
The MPIDR is: 


e Architecturally mapped to the AArch64 MPIDR_EL1[31:0] register. See 
B2.84 Multiprocessor Affinity Register, ELI on page B2-494. 
e Mapped to external EDDEVAFFO register. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
MPIDR is a 32-bit register. 
31 30 29 25 24 23 16 15 8 7 0 
MT— 
Figure B1-51 MPIDR bit assignments 
M, [31] 
Reserved, RESI. 
U, [30] 
Indicates a uniprocessor system, as distinct from core 0 in a multiprocessor system. This value is 
one of: 
(3 Processor is part of a multiprocessor system. This is the value for implementations 
with more than one core, and for implementations with an ACE or CHI interface. 
1 Processor is part of a uniprocessor system. This is the value for single core 
implementations with an AXI master interface. 
[29:25] 
Reserved, RESO. 
MT, [24] 


Indicates whether the lowest level of affinity consists of logical cores that are implemented 
using a multi-threading type approach. This value is: 


(2) Performance of cores at the lowest affinity level is largely independent. 


Aff2, [23:16] 
Affinity level 2. Second highest level affinity field. 


Indicates the value read in the CLUSTERIDAFF?2 configuration signal. 
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Aff1, [15:8] 
Affinity level 1. Third highest level affinity field. 


B1 AArch32 system registers 
B1.97 Multiprocessor Affinity Register 


Indicates the value read in the CLUSTERIDAFF1 configuration signal. 


Aff0, [7:0] 
Affinity level 0. Lowest level affinity field. 


Indicates the core number in the Cortex-A35 processor. The possible values are: 


exe A processor with one core only. 
xð, @x1 A cluster with two cores. 
xð, 0x1, 0x2 A cluster with three cores. 
@x®, 0x1, 0x2, 0x3 A cluster with four cores. 
To access the MPIDR: 


MRC p15,0,<Rt>,c@,c@,5 ; Read MPIDR into Rt 


Register access is encoded as follows: 


Table B1-82 MPIDR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0000 | 0000 | 101 
The EDDEVAFFO can be accessed through the external debug interface, offset @xFA8. 
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B1.98 Non-Secure Access Control Register 
The NSACR characteristics are: 


Purpose 

Defines the Non-secure access permission to CPO to CP13. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |-  |Ro [RO IRO |RW RW 





























Any read or write to NSACR in Secure EL1 state in AArch32 is trapped as an exception to EL3. 


Configurations 
There is one copy of this register that is used in both Secure and Non-secure states. 


If EL3 is using AArch64, then any reads of the NSACR from Non-secure EL2 or Non-secure 
EL1 using AArch32 return a fixed value of &x@0e80Ce2. 


In AArch64, the NSACR functionality is replaced by the behavior in CPTR_EL3. 





Attributes 
NSACR is a 32-bit register. 
31 16 15 14 12 11 10 9 0 
NSASEDIS — | | L—cp10 
Reserved cp11 
Figure B1-52 NSACR bit assignments 
[31:16] 


Reserved, RESO. 
NSASEDIS, [15] 
Disable Non-secure Advanced SIMD functionality: 
@ This bit has no effect on the ability to write CPACR.ASEDIS, this is the reset value. 


1 When executing in Non-secure state, the CPACR.ASEDIS bit has a fixed value of 1 and 
writes to it are ignored. 


If Advanced SIMD and floating-point are not implemented, this bit is REso. 


[14:12] 
Reserved, RESO. 
cp11, [11] 
Non-secure access to CP11 enable: 
© Secure access only. Any attempt to access CP11 in Non-secure state results in an Undefined 
Instruction exception. If the processor is in Non-secure state, the corresponding bits in the 
CPACR ignore writes and read as @b@@, access denied. This is the reset value. 


1 Secure or Non-secure access. 
If Advanced SIMD and Floating-point are not implemented, this bit is REso. 


cp10, [10] 
Non-secure access to CP10 enable: 
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B1.98 Non-Secure Access Control Register 


© Secure access only. Any attempt to access CP10 in Non-secure state results in an Undefined 
Instruction exception. If the processor is in Non-secure state, the corresponding bits in the 
CPACR ignore writes and read as @b@@, access denied. This is the reset value. 


1 Secure or Non-secure access. 


If Advanced SIMD and floating-point are not implemented, this bit is REso. 


[9:0] 
Reserved, RESO. 


If the CP11 and CP10 fields are set to different values, the behavior is CONSTRAINED 
UNPREDICTABLE. It is the same as if both fields were set to the value of CP10, in all respects other 


than the value read back by explicitly reading CP11. 
To access the NSACR: 


MRC p15, ©, <Rt>, c1, c1, 2 ; Read NSACR into Rt 
MCR p15, ©, <Rt>, c1, c1, 2 ; Write Rt to NSACR 


Register access is encoded as follows: 


Table B1-83 NSACR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0001 | 0001 | 010 
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B1.99 Normal Memory Remap Register 
The NMRR characteristics are: 


Purpose 
Provides additional mapping controls for memory regions that are mapped as Normal memory 
by their entry in the PRRR. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























The register is: 
e Used in conjunction with the PRRR. 
e Not accessible when using the Long-descriptor translation table format. 


Configurations 
If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


The Non-secure NMRR is architecturally mapped to the AArch64 MAIR_EL1[63:32] register 
when TTBCR.EAE==0. See B2.77 Memory Attribute Indirection Register, EL] on page B2-479. 


The Secure NMRR is mapped to the AArch64 MAIR_EL3[63:32] register when 
TTBCR.EAE==0. See B2.79 Memory Attribute Indirection Register, EL3 on page B2-482. 


Attributes 
NMRR is a 32-bit register when TTBCR.EAE is 0. 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16.15 14 13 1211109 8 76543210 





Figure B1-53 NMRR bit assignments 


ORn, [2n+17:2n+16] 
Outer Cacheable property mapping for memory attributes n, where n is 0-7, if the region is 
mapped as Normal memory by the PRRR.TRz entry. n is the value of the TEX[0], C and B bits, 
see Memory attributes and the n value for the PRRR field descriptions on page B1-311. The 
possible values of this field are: 
@bee Region is Non-cacheable. 
@be1 Region is Write-Back, Write-Allocate. 
@b10 Region is Write-Through, no Write-Allocate. 
@b11 Region is Write-Back, no Write-Allocate. 

IRn, [2n+1:2n] 
Inner Cacheable property mapping for memory attributes n, where n is 0-7, if the region is 
mapped as Normal Memory by the PRRR.TRz entry. n is the value of the TEX[0], C and B bits, 


see Memory attributes and the n value for the PRRR field descriptions on page B1-311. The 
possible values of this field are the same as those given for the ORz field. 


To access the NMRR: 


MRC p15, ©, <Rt>, c10, c2, 1 3 Read NMRR into Rt 
MCR p15, ©, <Rt>, c10, c2, 1 3 Write Rt to NMRR 


Register access is encoded as follows: 
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Table B1-84 NMRR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 1010 |0010 | 001 
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B1.100 Physical Address Register 
PAR 


The processor does not use any implementation-defined bits in the 32-bit format or 64-bit format PAR. 
Bit[8] is Reso. See the ARM® Architecture Reference Manual ARMv8, for ARMv8-A architecture profile 
for more information. 
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B1.101 Primary Region Remap Register 
The PRRR characteristics are: 


Purpose 

Controls the top level mapping of the TEX[0], C, and B memory region attributes. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























PRRR is not accessible when the Long-descriptor translation table format is in use. See, instead, 
B1.95 Memory Attribute Indirection Registers 0 and 1 on page B1-298. 


Configurations 
PRRR (NS) is architecturally mapped to AArch64 register MAIR_EL1[31:0] when 
TTBCR.EAE is 0. See B2.77 Memory Attribute Indirection Register, ELI on page B2-479. 


PRRR (S) is mapped to AArch64 register MAIR_EL3[31:0] when TTBCR.EAE is 0. See 
B2.79 Memory Attribute Indirection Register, EL3 on page B2-482. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Attributes 
PRRR is a 32-bit register when TTBCR.EAE==0. 


TWH 20191817161514131211109 8 76543 2 1 0 





Nosr- | | | noso Nst_| L bso 
Nosr- | | bros NSO DS1 
NOS5 NOS2 


NOS4 NOS3 





Figure B1-54 PRRR bit assignments 


NOSn, [24+n] 
Outer Shareable property mapping for memory attributes n, where n is 0-7, if the region is 
mapped as Normal Shareable. n is the value of the TEX[0], C and B bits concatenated. The 
possible values of each NOSn bit are: 
(3 Memory region is Outer Shareable. 


1 Memory region is Inner Shareable. 


The value of this bit is ignored if the region is Normal or Device memory that is not Shareable. 


[23:20] 
Reserved, RESO. 
NS1, [19] 
Mapping of S = 1 attribute for Normal memory. This bit gives the mapped Shareable attribute 
for a region of memory that: 
e Is mapped as Normal memory. 
e Has the S bit set to 1. 


The possible values of the bit are: 


(3 Region is not Shareable. 
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1 Region is Shareable. 


NSO, [18] 


Mapping of S = 0 attribute for Normal memory. This bit gives the mapped Shareable attribute 
for a region of memory that: 


e Is mapped as Normal memory. 
e Has the S bit set to 0. 


The possible values of the bit are the same as those given for the NS1 bit, bit[19]. 


DS1, [17] 


Mapping of S = 1 attribute for Device memory. This bit gives the mapped Shareable attribute for 
a region of memory that: 


e Is mapped as Device memory. 
e Has the S bit set to 1. 


This field has no significance in the processor. 


DSO, [16] 


Mapping of S = 0 attribute for Device memory. This bit gives the mapped Shareable attribute for 
a region of memory that: 


e Is mapped as Device memory. 
e Has the S bit set to 0. 


This field has no significance in the processor. 


TR», [2n+1:2n] 


Primary TEX mapping for memory attributes n, where n is 0-7. is the value of the TEX[0], C 
and B bits, see Memory attributes and the n value for the PRRR field descriptions 

on page B1-311. This field defines the mapped memory type for a region with attributes n. The 
possible values of the field are: 

@bee@ Device (nGnRnE). 

@b@1 Device (not nGnRnE). 

@b1@ Normal Memory. 


@b11 Reserved, effect is UNPREDICTABLE. 


The following table shows the mapping between the memory region attributes and the n value used in the 
PRRR.nOSn and PRRR.TRz2 field descriptions. 


Table B1-85 Memory attributes and the n value for the PRRR field descriptions 





















































Attributes n value 
TEX[0] | C | B 

0 0/0/10 

0 O;1)]1 

0 1/0 }2 

0 1/113 

1 0/0 |4 

1 07145 

1 1/0 |6 

1 1/117 
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Large physical address translations use Long-descriptor translation table formats and MAIRO replaces 
the PRRR, and MAIRI replaces the NMRR. For more information see B/.95 Memory Attribute 
Indirection Registers 0 and I on page B1-298. 


To access the PRRR: 


MRC p15, ©, <Rt>, c10, c2, @ 3 Read PRRR into Rt 
MCR p15, ©, <Rt>, c10, c2, @ 5 Write Rt to PRRR 


Register access is encoded as follows: 


Table B1-86 PRRR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 1010] 0010 | 000 
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B1.102 Revision ID Register 
The REVIDR characteristics are: 


Purpose 
Provides implementation-specific minor revision information that can be interpreted only in 
conjunction with the Main ID Register. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO |RO |RO RO 





























Configurations 
REVIDR is architecturally mapped to AArch64 register REVIDR_EL1. See B2.86 Revision ID 
Register, ELI on page B2-499, 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
REVIDR is a 32-bit register. 


31 0 


Figure B1-55 REVIDR bit assignments 


ID number, [31:0] 
Implementation-specific revision information. The reset value is determined by the specific 
Cortex-A35 processor implementation. 


0x00000000 Revision code is zero. 
To access the REVIDR: 
MRC p15, ©, <Rt>, c@, c@, 6; Read REVIDR into Rt 
Register access is encoded as follows: 


Table B1-87 REVIDR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0000 | 110 
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B1.103 Reset Management Register 
The RMR characteristics are: 


Purpose 

Controls the execution state that the processor boots into and allows request of a warm reset. 
Usage constraints 

This register is accessible as follows: 








ELO |ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
-o ee ee ee ee RW RW 





























Configurations 
The RMR is architecturally mapped to the AArch64 RMR_EL3 register. See B2.87 Reset 


Management Register, EL3 on page B2-500. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
RMR is a 32-bit register. 
31 210 
mF 
RR— 
AA64 
Figure B1-56 RMR bit assignments 

[31:2] 


Reserved, RESO. 
RR, [1] 
Reset Request. The possible values are: 


@ This is the reset value. 
1 Requests a warm reset. This bit is set to 0 by either a cold or warm reset. 


The bit is strictly a request. 
The RR bit drives the WARMRSTREQ output signal. 


AA64, [0] 
Determines which execution state the processor boots into after a warm reset. The possible 
values are: 


(7) AArch32 Execution state. 
1 AArch64 Execution state. 


The reset vector address on reset takes a choice between two values, depending on the value in 
the AA64 bit. This ensures that even with reprogramming of the AA64 bit, it is not possible to 
change the reset vector to go to a different location. 


The cold reset value depends on the AA64nAA32 signal. 
To access the RMR: 


MRC p15,0,<Rt>,c12,c@,2 ; Read RMR into Rt 
MCR p15,0,<Rt>,c12,c0,2 ; Write Rt to RMR 


Register access is encoded as follows: 
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Table B1-88 RMR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 1100 | 0000 | 010 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-315 


reserved. 
Non-Confidential 


B1 AArch32 system registers 
B1.104 Secure Configuration Register 


B1.104 Secure Configuration Register 
The SCR characteristics are: 


Purpose 
Defines the configuration of the current security state. It specifies: 
e The security state of the processor, Secure or Non-secure. 
e What state the processor branches to, if an IRQ, FIQ or external abort occurs. 
e Whether the CPSR.F and CPSR.A bits can be modified when SCR.NS = 1. 
Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW |- RW RW 





























Any read or write to SCR in Secure EL1 state in AArch32 is trapped as an exception to EL3. 
Configurations 


The SCR is a Restricted access register that exists only in the Secure state. 


The SCR is mapped to the AArch64 SCR_EL3 register. See B2.92 System Control Register, EL3 
on page B2-512. 


Attributes 
SCR is a 32-bit register. 


14131211109 8 765 43 2 1 





TWeE— SIF— 
TWI HCE 











SCD 
nET 
AW 
FW 
EA 
FIQ — 
IRQ 
NS 


Figure B1-57 SCR bit assignments 
[31:14] 
Reserved, RESO. 
TWE, [13] 
Trap WFE instructions. The possible values are: 


© WFE instructions are not trapped. This is the reset value. 


1 WFE instructions executed in any mode other than Monitor mode are trapped to Monitor mode 
aS UNDEFINED if the instruction would otherwise cause suspension of execution, that is if: 
¢ The event register is not set. 
e There is not a pending WFE wakeup event. 
¢ The instruction does not cause another exception. 


TWI, [12] 
Trap WFI instructions. The possible values are: 
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© WFI instructions are not trapped. This is the reset value. 


1 WFI instructions executed in any mode other than Monitor mode are trapped to Monitor mode 
aS UNDEFINED if the instruction would otherwise cause suspension of execution. 


[11:10] 
Reserved, RESO. 

SIF, [9] 
Secure Instruction Fetch. When the processor is in Secure state, this bit disables instruction 
fetches from Non-secure memory. The possible values are: 
© Secure state instruction fetches from Non-secure memory permitted. This is the reset value. 
1 Secure state instruction fetches from Non-secure memory not permitted. 

HCE, [8] 
Hyp Call enable. This bit enables use of the HVC instruction from Non-secure EL1 modes. The 
possible values are: 
© The HVC instruction is UNDEFINED in any mode. This is the reset value. 
1 The HVC instruction enabled in Non-secure EL1, and performs a Hyp Call. 

SCD, [7] 


Secure Monitor Call disable. Makes the SMC instruction UNDEFINED in Non-secure state. The 
possible values are: 


© SMC executes normally in Non-secure state, performing a Secure Monitor Call. This is the 
reset value. 


1 The SMC instruction is UNDEFINED in Non-secure state. 


A trap of the SMC instruction to Hyp mode takes priority over the value of this bit. 


nET, [6] 
Not Early Termination. This bit disables early termination. 


This bit is not implemented, REso. 


AW, [5] 
A bit writable. This bit controls whether CPSR.A can be modified in Non-secure state. 
e CPSR.A can be modified only in Secure state. This is the reset value. 
e CPSR.A can be modified in any security state. 


FW, [4] 
F bit writable. This bit controls whether CPSR.F can be modified in Non-secure state: 
e CPSR.F can be modified only in Secure state. This is the reset value. 
e CPSR.F can be modified in any security state. 

EA, [3] 


External Abort handler. This bit controls which mode takes external aborts. The possible values 
are: 


© External aborts taken in abort mode. This is the reset value. 
1 External aborts taken in Monitor mode. 
FIQ, [2] 
FIQ handler. This bit controls which mode takes FIQ exceptions. The possible values are: 
@ FIQs taken in FIQ mode. This is the reset value. 
1 FIQs taken in Monitor mode. 
IRQ, [1] 
IRQ handler. This bit controls which mode takes IRQ exceptions. The possible values are: 
@ IRQs taken in IRQ mode. This is the reset value. 
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NS, [0] 
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Non-secure bit. Except when the processor is in Monitor mode, this bit determines the security 


state of the processor. The possible values are: 


© Processor is in secure state. This is the reset value. 


1 Processor is in non-secure state. 


To access the SCR: 


MRC p15,0,<Rt>,c1,c1,@ ; Read SCR into Rt 
MCR p15,0,<Rt>,c1,c1,@ ; Write Rt to SCR 


Register access is encoded as follows: 


Table B1-89 SCR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0001 | 0001 | 000 
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B1.105 System Control Register 
The SCTLR characteristics are: 


Purpose 

Provides the top level control of the system, including its memory system. 
Usage constraints 

The SCTLR is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- [RW {Rw IRW [RW RW 





























Control bits in the SCTLR that are not applicable to a VMSA implementation read as the value 
that most closely reflects that implementation, and ignore writes. 


Some bits in the register are read-only. These bits relate to non-configurable features of an 
implementation, and are provided for compatibility with previous versions of the architecture. 


Configurations 


SCTLR (NS) is architecturally mapped to AArch64 register SCTLR_EL1. See B2.90 System 
Control Register, ELI on page B2-506. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Attributes 
SCTLR is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 9876543210 





UWXN 
RESO 


fe eee | Lone LRes1 lee 5BEN 
ire | Lincs THEE 
nTWE ITD 
i WXN SED 


Figure B1-58 SCTLR bit assignments 
[31] 
Reserved, RESO. 
TE, [30] 
T32 Exception enable. This bit controls whether exceptions are taken in A32 or T32 state: 
(3 Exceptions, including reset, taken in A32 state. 
1 Exceptions, including reset, taken in T32 state. 


The input CFGTE defines the reset value of the TE bit. 


AFE, [29] 
Access Flag Enable. This bit enables use of the AP[0] bit in the translation descriptors as the 
Access flag. It also restricts access permissions in the translation descriptors to the simplified 





model: 
() In the translation table descriptors, AP[0] is an access permissions bit. The full range 
of access permissions is supported. No Access flag is implemented. This is the reset 
value. 
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1 In the translation table descriptors, AP[0] is the Access flag. Only the simplified 
model for access permissions is supported. 


TRE, [28] 
TEX remap enable. This bit enables remapping of the TEX[2:1] bits for use as two translation 
table bits that can be managed by the operating system. Enabling this remapping also changes 
the scheme used to describe the memory region attributes in the VMSA: 


(3 TEX remap disabled. TEX[2:0] are used, with the C and B bits, to describe the 
memory region attributes. This is the reset value. 


1 TEX remap enabled. TEX[2:1] are reassigned for use as bits managed by the operating 
system. The TEX[0], C and B bits are used to describe the memory region attributes, 
with the MMU remap registers. 


[27:26] 
Reserved, RESO. 

EE, [25] 
Exception Endianness bit. The value of this bit defines the value of the CPSR.E bit on entry to 
an exception vector, including reset. This value also indicates the endianness of the translation 
table data for translation table lookups: 


@ Little endian. 
1 Big endian. 


The input CFGEND defines the reset value of the EE bit. 


[24] 
Reserved, RESO. 

[23:22] 
Reserved, RES1. 

[21] 
Reserved, RESO. 

UWXN, [20] 
Unprivileged write permission implies EL1 Execute Never (XN). This bit can be used to require 
all memory regions with unprivileged write permissions to be treated as XN for accesses from 
software executing at EL1. 


(3 Regions with unprivileged write permission are not forced to be XN, this is the reset 
value. 
1 Regions with unprivileged write permission are forced to be XN for accesses from 


software executing at EL1. 


WXN, [19] 
Write permission implies Execute Never (XN). This bit can be used to require all memory 
regions with write permissions to be treated as XN. 


@ Regions with write permission are not forced to be XN, this is the reset value. 
1 Regions with write permissions are forced to be XN. 
nTWE, [18] 
Not trap WFE. 
(3 Ifa WFE instruction executed at ELO would cause execution to be suspended, such as 


if the event register is not set and there is not a pending WFE wakeup event, it is taken 
as an exception to EL1 using the 0x1 ESR code. 





1 WFE instructions are executed as normal. 
[17] 
Reserved, RESO. 
nTWI, [16] 
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Not trap WFI. 


(3 Ifa WFI instruction executed at ELO would cause execution to be suspended, such as 
if there is not a pending WFI wakeup event, it is taken as an exception to EL1 using 
the 0x1 ESR code. 


1 WFI instructions are executed as normal. 
[15:14] 
Reserved, RESO. 
V, [13] 
Vectors bit. This bit selects the base address of the exception vectors: 


© Normal exception vectors, base address 0x00000000. Software can remap this base address 
using the VBAR. 


1 High exception vectors, base address @xFFFFQ0G0. This base address is never remapped. 


The input VINITHI defines the reset value of the V bit. 


I, [12] 

Instruction cache enable bit. This is a global enable bit for instruction caches: 

(3 Instruction caches disabled. If SCTLR.M is set to 0, instruction accesses from stage 1 
of the ELO/EL1 translation regime are to Normal memory, Outer Shareable, Inner 
Non-cacheable, Outer Non-cacheable. 

1 Instruction caches enabled. If SCTLR.M is set to 0, instruction accesses from stage 1 
of the ELO/EL1 translation regime are to Normal memory, Outer Shareable, Inner 
Write-Through, Outer Write-Through. 

[11] 

Reserved, RES1 
[10:9] 

Reserved, RES0 
SED, [8] 

SETEND Disable: 

[2] The SETEND instruction is available. 

1 The SETEND instruction is UNALLOCATED. 

ITD, [7] 

IT Disable: 

(3 The IT instruction functionality is available. 

1 All encodings of the IT instruction with hw1[3:0]!=1000 are UNDEFINED and treated as 
unallocated. All encodings of the subsequent instruction with the following values for 
hw1 are UNDEFINED (and treated as unallocated): 
11xxxxxXxxXxXxxxxxx All 32-bit instructions, B(2), B(1), Undefined, SVC, Load/Store 

multiple 
1x11xxxxxxxxxxxx Miscellaneous 16-bit instructions 
1x10@xxxxxxxxxxx ADD Rd, PC, #imm 
@1001xxxxxxxxxxx LDR Rd, [PC, #imm] 
@100x1xxx1111xxx ADD(4),CMP(3), MOV, BX pc, BLX pc 
@10001xx1xxxx111 ADD(4),CMP(3), MOV 
THEE, [6] 


Reserved, RESO. 
CP15BEN, [5] 
CP15 barrier enable. 





ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B1-321 
reserved. 
Non-Confidential 


[4:3] 


C, [2] 


A, [1] 


M, [0] 
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(3 CP15 barrier operations disabled. Their encodings are UNDEFINED. 
1 CP15 barrier operations enabled. 


Reserved, RES1. 


Cache enable. This is a global enable bit for data and unified caches: 


@ Data and unified caches disabled, this is the reset value. 


1 Data and unified caches enabled. 


Alignment check enable. This is the enable bit for Alignment fault checking: 


(3 Alignment fault checking disabled, this is the reset value. 
1 Alignment fault checking enabled. 


MMU enable. This is a global enable bit for the MMU stage 1 address translation: 


@ ELl and ELO stage 1 MMU disabled. 
1 ELI and ELO stage 1 MMU enabled. 


To access the SCTLR: 


MRC p15, ©, <Rt>, c1, c@, @ ; Read SCTLR into Rt 
MCR p15, ©, <Rt>, c1, c0, © ; Write Rt to SCTLR 


Register access is encoded as follows: 


Table B1-90 SCTLR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0001 | 0000 | 000 
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B1.106 Secure Debug Control Register 
The SDCR characteristics are: 
Purpose 
Controls debug and performance monitors functionality in Secure state. 
Usage constraints 
This register is accessible as follows: 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
= z - RW |- RW RW 
Configurations 
SDCR is mapped to AArch64 register MDCR_EL3. See B2.8/ Monitor Debug Configuration 
Register, EL3 on page B2-486. 
Attributes 
SDCR is a 32-bit register. 
31 22 21 20 19 18 17 16 15 14 13 0 
EPMAD— L- SPD 
EDAD RESO 
SPME 
Figure B1-59 SDCR bit assignments 
[31:22] 
Reserved, RESO. 
EPMAD, [21] 
External debugger access to Performance Monitors registers disabled. This disables access to 
these registers by an external debugger: 
© Access to Performance Monitors registers from external debugger is permitted. This is the 
reset value. 
1 Access to Performance Monitors registers from external debugger is disabled, unless 
overridden by authentication interface. 
EDAD, [20] 
External debugger access to breakpoint and watchpoint registers disabled. This disables access 
to these registers by an external debugger: 
© Access to breakpoint and watchpoint registers from external debugger is permitted. This is 
the reset value. 
1 Access to breakpoint and watchpoint registers from external debugger is disabled, unless 
overridden by authentication interface. 
[19:18] 
Reserved, RESO. 
SPME, [17] 
Secure performance monitors enable. This allows event counting in Secure state: 
© Event counting prohibited in Secure state, unless overridden by the authentication interface. 
This is the reset value. 
1 Event counting allowed in Secure state. 
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[16] 


B1 AArch32 system registers 
B1.106 Secure Debug Control Register 


Reserved, RESO. 


SPD, [15:14] 


[13:0] 


AArch32 secure privileged debug. Enables or disables debug exceptions in Secure state, other 
than Software breakpoint instructions. The possible values are: 


@bee@ Legacy mode. Debug exceptions from Secure EL1 are enabled by the authentication 
interface. 


@b1@ Secure privileged debug disabled. Debug exceptions from Secure EL] are disabled. 
@b11 Secure privileged debug enabled. Debug exceptions from Secure EL] are enabled. 
The value @b@1 is reserved. 


If debug exceptions from Secure EL1 are enabled, then debug exceptions from Secure ELO are 
also enabled. 


Otherwise, debug exceptions from Secure ELO are enabled only if SDER32_ EL3.SUIDEN is 1. 


SPD is ignored in Non-secure state. Debug exceptions from Software breakpoint instruction 
debug events are always enabled. 


Reserved, RESO. 


To access the SDCR: 


MRC p15,0,<Rt>,c1,c3,1 ; Read SDCR into Rt 
MCR p15,0,<Rt>,c1,c3,1 ; Write Rt to SDCR 


Register access is encoded as follows: 


Table B1-91 SDCR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0001} 0011 | 001 
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B1 AArch32 system registers 
B1.107 Secure Debug Enable Register 


B1.107 Secure Debug Enable Register 


The SDER characteristics are: 


Purpose 

Controls invasive and non-invasive debug in the Secure ELO state. 
Usage constraints 

This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) (S) (SCR.NS = 1) | (SCR.NS = 0) 
- f- |. JRw]- [Rw RW 





























Configurations 
SDER is architecturally mapped to AArch64 register SDER32_EL3. See B2.93 Secure Debug 
Enable Register, EL3 on page B2-514. 


This register is accessible only in Secure state. 


Attributes 
SDER is a 32-bit register. 
31 210 
mT 
SUNIDEN al 
SUIDEN 
Figure B1-60 SDER bit assignments 

[31:2] 


Reserved, RESO. 
SUNIDEN, [1] 
Secure User Non-invasive Debug Enable. The possible values are: 


© Non-invasive debug not permitted in Secure ELO state. This is the Warm reset value. 


1 Non-invasive debug permitted in Secure ELO state. 


SUIDEN, [0] 
Secure User Invasive Debug Enable. The possible values are: 


© Invasive debug not permitted in Secure ELO state. This is the Warm reset value. 


1 Invasive debug permitted in Secure ELO state. 


To access the SDER: 


MRC p15,0,<Rt>,c1,c1,1 ; Read SDER into Rt 
MCR p15,0,<Rt>,c1,c1,1 ; Write Rt to SDER 


Register access is encoded as follows: 


Table B1-92 SDER access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 |0001 |0001 |001 
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B1 AArch32 system registers 
B1.108 TCM Type Register 


B1.108 TCM Type Register 
TCMTR 
The processor does not implement the features described by the TCMTR. This register is always RAZ. 
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B1 AArch32 system registers 
B1.109 TLB Type Register 


B1.109 TLB Type Register 
TLBTR 
The processor does not implement the features described by the TLBTR. This register is always RAZ. 
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B1 AArch32 system registers 
B1.110 Translation Table Base Control Register 


B1.110 Translation Table Base Control Register 
The TTBCR characteristics are: 


Purpose 
Determines which of the Translation Table Base Registers defines the base address for a 
translation table walk required for the stage 1 translation of a memory access from any mode 
other than Hyp mode. Also controls the translation table format and, when using the Long- 
descriptor translation table format, holds cacheability and shareability information. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























The processor does not use the implementation-defined bit, TTBCR[30], when using the Long- 
descriptor translation table format, so this bit is RESO. 


Configurations 
TTBCR (NS) is architecturally mapped to AArch64 register TCR_EL1. See B2.94 Translation 
Control Register, ELI on page B2-515. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Attributes 
TTBCR is a 32-bit register. 


There are two formats for this register. TTBCR.EAE determines which format of the register is used. 
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B1 AArch32 system registers 
B1.111 TTBCR with Short-descriptor translation table format 


B1.111 TTBCR with Short-descriptor translation table format 


TTBCR has a specific format when using the Short-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


The following figure shows the TTBCR bit assignments when TTBCR.EAE is 0. 


31 30 65432 0 
L_EAE PD1— L— RESO 
PDO 


Figure B1-61 TTBCR bit assignments, TTBCR.EAE is 0 


EAE, [31] 
Extended Address Enable. 


(3 Use the 32-bit translation system, with the Short-descriptor translation table format. 


[30:6] 
Reserved, RESO. 

PD1, [5] 
Translation table walk disable for translations using TTBR1. This bit controls whether a 
translation table walk is performed on a TLB miss, for an address that is translated using 
TTBRI1. The possible values are: 


© Perform translation table walks using TTBR1. 


1 
A TLB miss on an address that is translated using TTBR1 generates a Translation fault. 
No translation table walk is performed. 


PDO, [4] 
Translation table walk disable for translations using TTBRO. This bit controls whether a 


translation table walk is performed on a TLB miss for an address that is translated using 
TTBRO. The possible values are: 


© Perform translation table walks using TTBRO. 


1 
A TLB miss on an address that is translated using TTBRO generates a Translation fault. 
No translation table walk is performed. 
[3] 
Reserved, RESO. 
N, [2:0] 
Indicate the width of the base address held in TTBRO. In TTBRO, the base address field is 
bits[31:14-N]. The value of N also determines: 
e Whether TTBRO or TTBR1 is used as the base address for translation table walks. 
e The size of the translation table pointed to by TTBRO. 


N can take any value from 0 to 7, that is, from 0b000 to 0b111. 


When N has its reset value of 0, the translation table base is compatible with ARMv5 and 
ARMv6. 


Resets to 0. 
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B1 AArch32 system registers 
B1.112 TTBCR with Long-descriptor translation table format 


B1.112 TTBCR with Long-descriptor translation table format 


TTBCR has a specific format when using the Long-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


The following figure shows the TTBCR bit assignments when TTBCR.EAE is 1. 


31 30 29 28 27 26 25 24 23 22 21 1918 161514131211109 8 7 6 3 2 0 





L— RESO L—EPD1 L—EPDO 
EAE IRGN1 IRGNO 
ORGN1 ORGNO 


Figure B1-62 TTBCR bit assignments, TTBCR.EAE is 1 


EAE, [31] 
Extended Address Enable: 
1 Use the 40-bit translation system, with the Long-descriptor translation table 
format. 


[30] 
Reserved, RESO. 
SH1, [29:28] 
Shareability attribute for memory associated with translation table walks using TTBR1: 


e@bee Non-shareable. 
@b10 Outer Shareable. 
@b11 Inner Shareable. 


Other values are reserved. 
Resets to 0. 


ORGNI, [27:26] 
Outer cacheability attribute for memory associated with translation table walks using TTBR1: 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 
Resets to 0. 


IRGNI1, [25:24] 
Inner cacheability attribute for memory associated with translation table walks using TTBR1: 


@bee Normal memory, Inner Non-cacheable. 
@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Inner Write-Through Cacheable. 
@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
Resets to 0. 

EPD1, [23] 


Translation table walk disable for translations using TTBR1. This bit controls whether a 
translation table walk is performed on a TLB miss, for an address that is translated using 
TTBRI: 
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B1 AArch32 system registers 
B1.112 TTBCR with Long-descriptor translation table format 


2) 
Perform translation table walks using TTBR1. 
1 
A TLB miss on an address that is translated using TTBR1 generates a Translation fault. 
No translation table walk is performed. 
A1, [22] 
Selects whether TTBRO or TTBR1 defines the ASID: 
(2) TTBRO.ASID defines the ASID. 
1 TTBR1.ASID defines the ASID. 
[21:19] 


Reserved, RESO. 
TISZ, [18:16] 
The size offset of the memory region addressed by TTBR1. The region size is 23%-T!SZ bytes. 


Resets to 0. 


[15:14] 
Reserved, RESO. 
SHO, [13:12] 
Shareability attribute for memory associated with translation table walks using TTBRO: 


e@bee Non-shareable. 
@b10 Outer Shareable. 
@b11 Inner Shareable. 


Other values are reserved. 
Resets to 0. 


ORGNDO, [11:10] 
Outer cacheability attribute for memory associated with translation table walks using TTBRO: 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 
Resets to 0. 


IRGNO, [9:8] 
Inner cacheability attribute for memory associated with translation table walks using TTBRO: 


@bee Normal memory, Inner Non-cacheable. 
@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Inner Write-Through Cacheable. 
@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
Resets to 0. 

EPDO, [7] 


Translation table walk disable for translations using TTBRO. This bit controls whether a 
translation table walk is performed on a TLB miss, for an address that is translated using 





TTBRO: 
(3 Perform translation table walks using TTBRO. 
1 A TLB miss on an address that is translated using TTBRO generates a Translation 
fault. No translation table walk is performed. 
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[6:3] 
Reserved, RESO. 
TOSZ, [2:0] 


B1 AArch32 system registers 
B1.112 TTBCR with Long-descriptor translation table format 


The size offset of the memory region addressed by TTBRO. The region size is 232-17 bytes. 


Resets to 0. 
To access the TTBCR: 


MRC p15,0,<Rt>,c2,c@,@ ; Read TTBR@ into Rt 
MCR p15,0,<Rt>,c2,c0,@ ; Write Rt to TTBRO 


Register access is encoded as follows: 


Table B1-93 TTBCR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0010} 0000 | 010 
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B1.113 Translation Table Base Register 0 
The TTBRO characteristics are: 


Purpose 


B1 AArch32 system registers 


B1.113 Translation Table Base Register 0 


Holds the base address of translation table 0, and information about the memory it occupies. 
This is one of the translation tables for the stage 1 translation of memory accesses from modes 


other than Hyp mode. 
Usage constraints 
This register is accessible as follows: 


























ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW |RW | RW RW 











Used in conjunction with the TTBCR. When the 64-bit TTBRO format is used, cacheability and 


shareability information is held in the TTBCR and not in TTBRO. 


Configurations 


TTBRO (NS) is architecturally mapped to AArch64 register TTBRO_EL1. See 
B2.97 Translation Table Base Register 0, EL] on page B2-523. 


TTBRO (S) is mapped to AArch64 register TTBRO_EL3. See 82.99 Translation Table Base 


Register 0, EL3 on page B2-525. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Attributes 
TTBRO is: 
e A 32-bit register when TTBCR.EAE is 0. 
e A 64-bit register when TTBCR.EAE is 1. 


There are different formats for this register. TTBCR.EAE determines which format of the register is 


used. 
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B1 AArch32 system registers 
B1.114 TTBRO with Short-descriptor translation table format 


B1.114 TTBRO with Short-descriptor translation table format 


TTBRO has a specific format when using the Short-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


The following figure shows the TTBRO bit assignments when TTBCR.EAE is 0. 


31 76543 2 1 0 


IRGN[0] ail 
NOS 
RESO 
S 
IRGN[1] 





Figure B1-63 TTBRO bit assignments, TTBCR.EAE is 0 


TTBO, [31:7] 
Translation table base 0 address, bits[31:x], where x is 14-(TTBCR.N). Bits [x-1:7] are Reso. 


The value of x determines the required alignment of the translation table, that must be aligned to 
2* bytes. 


If bits [x-1:7] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, where bits [x-1:7] are treated as if all the bits are zero. The value 
read back from those bits is the value written. 


IRGN[0], [6] 
See bit[0] for description of the IRGN field. 

NOS, [5] 
Not Outer Shareable bit. Indicates the Outer Shareable attribute for the memory associated with 
a translation table walk that has the Shareable attribute, indicated by TTBRO.S is 1. The possible 


values are: 
(7) Outer Shareable. 
1 Inner Shareable. 


This bit is ignored when TTBRO:S is 0. 


RGN, [4:3] 
Region bits. Indicates the Outer cacheability attributes for the memory associated with the 
translation table walks. The possible values are: 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b1e Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


[2] 
Reserved, RESO. 
S, [1] 
Shareable bit. Indicates the Shareable attribute for the memory associated with the translation 
table walks. The possible values are: 
(3 Non-shareable. 


1 Shareable. 
IRGN[1], [0] 
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B1 AArch32 system registers 
B1.114 TTBRO with Short-descriptor translation table format 


Inner region bits. Indicates the Inner Cacheability attributes for the memory associated with the 
translation table walks. The possible values of IRGN[1:0] are: 


@bee 
@be1 
@b10 
@b11 


The encoding of the IRGN bits is counter-intuitive, with register bit[6] being IRGN[0] and 


Normal memory, Inner Non-cacheable. 


Normal memory, Inner Write-Back Write-Allocate Cacheable. 


Normal memory, Inner Write-Through Cacheable. 


Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


register bit[0] being IRGN[1]. This encoding is chosen to give a consistent encoding of memory 
region types and to ensure that software written for ARMv7 without the Multiprocessing 
Extensions can run unmodified on an implementation that includes the functionality introduced 
by the ARMv7 Multiprocessing Extensions. 


To access the TTBRO when TTBCR.EAE is 0: 


MRC p15,0,<Rt>,c2,c@,@ ; Read TTBR@ into Rt 
MCR p15,0,<Rt>,c2,c0,@ ; Write Rt to TTBRO 


Register access is encoded as follows: 


Table B1-94 TTBRO access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0010} 0000 | 000 
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B1 AArch32 system registers 
B1.115 TTBRO with Long-descriptor translation table format 


B1.115 TTBRO with Long-descriptor translation table format 


TTBRO has a specific format when using the Long-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


The following figure shows the TTBRO bit assignments when TTBCR.EAE is 1. 


56 55 48 47 0 


63 
RESO | ASID | BADDR[47:x] 


Figure B1-64 TTBRO bit assignments, TTBCR.EAE is 1 


[63:56] 
Reserved, RESO. 
ASID, [55:48] 
An ASID for the translation table base address. The TTBCR.AI field selects either 
TTBRO.ASID or TTBR1.ASID. 
BADDR[47:x], [47:0] 
Translation table base address, bits[47:x]. Bits [x-1:0] are REso. 
x is based on the value of TTBCR.TOSZ, and is calculated as follows: 
e IfTTBCR.TOSZ is 0 or 1, x = 5 - TTBCR.TOSZ. 
e IfTTBCR.TOSZ is greater than 1, x = 14 - TTBCR.TOSZ. 


The value of x determines the required alignment of the translation table, that must be aligned to 
2x bytes. 


If bits [x-1:3] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, Where bits [x-1:0] are treated as if all the bits are zero. The value 
read back from those bits is the value written. 


To access the TTBRO when TTBCR.EAE==1: 


MRRC p15,0,<Rt>,<Rt2>,c2 ; Read 64-bit TTBR@ into Rt (low word) and Rt2 (high word) 
MCRR p15,0,<Rt>,<Rt2>,c2 ; Write Rt (low word) and Rt2 (high word) to 64-bit TTBR@ 


Register access is encoded as follows: 


Table B1-95 TTBRO access encoding 





coproc | opc1 | CRm 














1111 0000 | 0010 
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B1 AArch32 system registers 
B1.116 Translation Table Base Register 1 


B1.116 Translation Table Base Register 1 
The TTBR1 characteristics are: 


Purpose 
Holds the base address of translation table 1, and information about the memory it occupies. 
This is one of the translation tables for the stage 1 translation of memory accesses from modes 
other than Hyp mode. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























Used in conjunction with the TTBCR. When the 64-bit TTBR1 format is used, cacheability and 
shareability information is held in the TTBCR and not in TTBR1. See B/.//0 Translation Table 
Base Control Register on page B1-328. 


Configurations 
TTBRI (NS) is architecturally mapped to AArch64 register TTBRO EL1. See 
B2.98 Translation Table Base Register 1, EL] on page B2-524. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


Attributes 
TTBRI1 is: 
e A 32-bit register when TTBCR.EAE is 0. 
e A 64-bit register when TTBCR.EAE is 1. 


There are two formats for this register. TTBCR.EAE determines which format of the register is used. 
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B1 AArch32 system registers 
B1.117 TTBR1 with Short-descriptor translation table format 


B1.117 TTBR1 with Short-descriptor translation table format 


TTBRI has a specific format when using the Short-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


The following figure shows the TTBR1 bit assignments when TTBCR.EAE is 0. 


31 76543 2 1 


IRGN[0] — RESO Fy 
NOS A 
IRGN[1] 


Figure B1-65 TTBR1 bit assignments, TTBCR.EAE is 0 


TTB1, [31:7] 
Translation table base 1 address, bits[31:x], where x is 14-(TTBCR.N). Bits [x-1:7] are Reso. 


The translation table must be aligned on a 16KByte boundary. 


If bits [x-1:7] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, Where bits [x-1:7] are treated as if all the bits are zero. The value 
read back from those bits is the value written. 


IRGN[0], [6] 
See IRGN[1] below for description of the IRGN field. 

NOS, [5] 
Not Outer Shareable bit. Indicates the Outer Shareable attribute for the memory associated with 
a translation table walk that has the Shareable attribute, indicated by TTBRO.S is 1. The possible 


values are: 
e Outer Shareable. 
1 Inner Shareable. 


This bit is ignored when TTBRO:S is 0. 


RGN, [4:3] 
Region bits. Indicates the Outer cacheability attributes for the memory associated with the 
translation table walks. The possible values are: 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 

@b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 
IMP, [2] 


Reserved, RESO. 
S, [1] 
Shareable bit. Indicates the Shareable attribute for the memory associated with the translation 
table walks. The possible values are: 
@ Non-shareable. 


1 Shareable. 


IRGN[1], [0] 
Inner region bits. Indicates the Inner Cacheability attributes for the memory associated with the 
translation table walks. The possible values of IRGN[1:0] are: 


@bee@ Normal memory, Inner Non-cacheable. 
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B1 AArch32 system registers 
B1.117 TTBR1 with Short-descriptor translation table format 


@b@1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 


@b1@ Normal memory, Inner Write-Through Cacheable. 
@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


The encoding of the IRGN bits is counter-intuitive, with register bit[6] being IRGN[0] and 
register bit[0] being IRGN[1]. This encoding is chosen to give a consistent encoding of memory 
region types and to ensure that software written for ARMv7 without the Multiprocessing 
Extensions can run unmodified on an implementation that includes the functionality introduced 
by the ARMv7 Multiprocessing Extensions. 


To access the TTBR1 when TTBCR.EAE is 0: 


MRC p15, @, <Rt>, c2, c@, 1 ; Read TTBR1 into Rt 
MCR p15, ©, <Rt>, c2, c0, 1 ; Write Rt to TTBR1 


Register access is encoded as follows: 


Table B1-96 TTBR1 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0010} 0000 | 001 
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B1 AArch32 system registers 
B1.118 TTBR1 with Long-descriptor translation table format 


B1.118 TTBR1 with Long-descriptor translation table format 


TTBRI has a specific format when using the Long-descriptor translation table format. TTBCR.EAE 
determines which format of the register is in use. 


The following figure shows the TTBR1 bit assignments when TTBCR.EAE is 1. 


56 55 48 47 0 


63 
RESO | ASID | BADDR[47:x] 


Figure B1-66 TTBR1 bit assignments, TTBCR.EAE is 1 


[63:56] 
Reserved, RESO. 
ASID, [55:48] 
An ASID for the translation table base address. The TTBCR.AI field selects either 
TTBRO.ASID or TTBR1.ASID. 
BADDR[47:x], [47:0] 
Translation table base address, bits[47:x]. Bits [x-1:0] are REso. 
x is based on the value of TTBCR.TOSZ, and is calculated as follows: 
e IfTTBCR.TOSZ is 0 or 1, x = 5 - TTBCR.TOSZ. 
e IfTTBCR.TOSZ is greater than 1, x = 14 - TTBCR.TOSZ. 


The value of x determines the required alignment of the translation table, that must be aligned to 
2x bytes. 


If bits [x-1:3] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, Where bits [x-1:0] are treated as if all the bits are zero. The value 
read back from those bits is the value written. 


To access the 64-bit TTBR1 when TTBCR.EAE = 1: 


MRRC p15, 1, <Rt>, <Rt2>, c2 ; Read 64-bit TTBR1 into Rt (low word) and Rt2 (high word) 
MCRR p15, 1, <Rt>, <Rt2>, c2 ; Write Rt (low word) and Rt2 (high word) to 64-bit TTBR1 


Register access is encoded as follows: 


Table B1-97 TTBRO access encoding 





coproc | opc1 | CRm 














1111 0001 | 0010 
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B1 AArch32 system registers 
B1.119 Vector Base Address Register 


B1.119 Vector Base Address Register 
The VBAR characteristics are: 


Purpose 
Holds the exception base address for exceptions that are not taken to Monitor mode or to Hyp 
mode when high exception vectors are not selected. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 





























Software must program the Non-secure instance of the register with the required initial value as 
part of the processor boot sequence. 


Configurations 
If EL3 is using AArch32, there are separate Secure and Non-secure instances of this register. 


The Non-secure VBAR is architecturally mapped to the AArch64 VBAR ELI register. See 
B2.100 Vector Base Address Register, ELI on page B2-526. 


The Secure VBAR is mapped to AArch64 register VBAR_EL3[31:0]. See B2./02 Vector Base 
Address Register, EL3 on page B2-528. 


Attributes 
VBAR is a 32-bit register. 


31 5 4 0 


Vector Base Address 


Figure B1-67 VBAR bit assignments 


Vector Base Address, [31:5] 
Bits[31:5] of the base address of the exception vectors, for exceptions taken in this exception 
level. Bits[4:0] of an exception vector are the exception offset. 

[4:0] 
Reserved, RESO. 


To access the VBAR: 


MRC p15, ©, <Rt>, c12, c0, @ ; Read VBAR into Rt 
MCR p15, ©, <Rt>, c12, c@, © ; Write Rt to VBAR 


Register access is encoded as follows: 


Table B1-98 VBAR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 1100 | 0000 | 000 
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B1 AArch32 system registers 
B1.120 Virtualization Multiprocessor ID Register 


B1.120 Virtualization Multiprocessor ID Register 
The VMPIDR characteristics are: 


Purpose 
Provides the value of the Virtualization Multiprocessor ID. This is the value returned by Non- 
secure EL! reads of MPIDR. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) (S) (SCR.NS = 1) | (SCR.NS = 0) 
z = Js -  |RW | RW : 





























Configurations 


VMPIDR is architecturally mapped to AArch64 register VMPIDR_EL2[31:0]. See 
B2.103 Virtualization Multiprocessor ID Register, EL2 on page B2-529. 


This register is accessible only at EL2 or EL3. 


Attributes 
VMPIDR is a 32-bit register. 


VMPIDR resets to the value of MPIDR. 


31 0 


VMPIDR 


Figure B1-68 VMPIDR bit assignments 
VMPIDR, [31:0] 


MPIDR value returned by Non-secure EL1 reads of the MPIDR. The MPIDR description 
defines the subdivision of this value. See Figure BI-51 MPIDR bit assignments 
on page B1-303. 


To access the VMPIDR: 


MRC p15,4,<Rt>,c@,c@,5 ; Read VMPIDR into Rt 
MCR p15,4,<Rt>,c@,c@,5 ; Write Rt to VMPIDR 


Register access is encoded as follows: 


Table B1-99 VMPIDR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 100 | 0000 | 0000 | 101 
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B1 AArch32 system registers 
B1.121 Virtualization Processor ID Register 


B1.121 Virtualization Processor ID Register 
The VPIDR characteristics are: 


Purpose 
Holds the value of the Virtualization Processor ID. This is the value returned by Non-secure 
EL1 reads of MIDR. See Figure B1-50 MIDR bit assignments on page B1-301. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) (S) (SCR.NS = 1) | (SCR.NS = 0) 
z = Js - |RW | RW : 





























Configurations 
VPIDR is architecturally mapped to AArch64 register VPIDR_EL2. See B2./04 Virtualization 
Processor ID Register, EL2 on page B2-530. 

Attributes 
VPIDR is a 32-bit register. 


VPIDR resets to the value of MIDR. 


31 0 


VPIDR 


Figure B1-69 VPIDR bit assignments 


VPIDR, [31:0] 
MIDR value returned by Non-secure PL1 reads of the MIDR. The MIDR description defines the 
subdivision of this value. See Figure B1-50 MIDR bit assignments on page B1-301. 


To access the VPIDR: 


MRC p15,4,<Rt>,c@,c@,@ ; Read VPIDR into Rt 
MCR p15,4,<Rt>,c@,c@,® ; Write Rt to VPIDR 


Register access is encoded as follows: 


Table B1-100 VPIDR access encoding 





coproc | opc1 | CRn | CRm | opc2 

















1111 100 | 0000 |0000 | 000 
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B1 AArch32 system registers 
B1.122 Virtualization Translation Control Register 


B1.122 Virtualization Translation Control Register 
The VTCR characteristics are: 


Purpose 
Controls the translation table walks required for the stage 2 translation of memory accesses from 
Non-secure modes other than Hyp mode, and holds cacheability and shareability information for 
the accesses. 

Usage constraints 
This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
s le ‘|e |e | Rw lew s 





























Used in conjunction with VTTBR, that defines the translation table base address for the 
translations. 


Configurations 
VTCR is architecturally mapped to AArch64 register VTCR_EL2. See B2.105 Virtualization 
Translation Control Register, EL2 on page B2-531. 


This register is accessible only at EL2 or EL3. 


Attributes 
VTCR is a 32-bit register. 
31 30 14131211109 8 7 6 5 4 3 
Lres1 ORGNO L RESO 
IRGNO 
Figure B1-70 VTCR bit assignments 
[31] 


Reserved, RESI. 
[30:14] 
Reserved, RESO. 
SHO, [13:12] 
Shareability attribute for memory associated with translation table walks using TTBRO. 
boð  Non-shareable. 
@b@1 Reserved. 
@b1@ Outer Shareable. 
@b11 Inner Shareable. 
ORGNDO, [11:10] 
Outer cacheability attribute for memory associated with translation table walks using TTBRO. 
@bee@ Normal memory, Outer Non-cacheable. 
@b@1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b1@ Normal memory, Outer Write-Through Cacheable. 
@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


IRGNO, [9:8] 
Inner cacheability attribute for memory associated with translation table walks using TTBRO. 
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e@bee 
@be1 
@b10 
@b11 


SLO, [7:6] 


Normal memory, Inner Non-cacheable. 


B1 AArch32 system registers 
B1.122 Virtualization Translation Control Register 


Normal memory, Inner Write-Back Write-Allocate Cacheable. 


Normal memory, Inner Write-Through Cacheable. 


Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


Starting level for translation table walks using VT TBR: 


@bee 
@be1 


[5] 


Start at second level. 
Start at first level. 


Reserved, RESO. 


S, [4] 
Sign extension bit. This bit must be programmed to the value of TOSZ[3]. If it is not, then the 
stage 2 TOSZ value is treated as an UNKNOWN value within the legal range that can be 
programmed. 
TOSZ, [3:0] 
The size offset of the memory region addressed by TTBRO. The region size is 232-17 bytes. 
To access the VTCR: 


MRC p15, 4, <Rt>, c2, c1, 2; Read VTCR into Rt 
MCR p15, 4, <Rt>, c2, c1, 2; Write Rt to VTCR 


Register access is encoded as follows: 


Table B1-101 VTCR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 100 |0010 |0001 | 010 
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B1 AArch32 system registers 
B1.122 Virtualization Translation Control Register 
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Chapter B2 
AArch64 system registers 


This chapter describes the system registers in the AArch64 state. 


It contains the following sections: 

e B2.1 AArch64 register summary on page B2-350. 

e B2.2 AArch64 Identification registers on page B2-351. 

e B2.3 AArch64 Exception handling registers on page B2-353. 

e B2.4 AArch64 Virtual memory control registers on page B2-354. 

e B2.5 AArch64 Other System control registers on page B2-356. 

e B2.6 AArch64 Cache maintenance operations on page B2-357. 

e B2.7 AArch64 TLB maintenance operations on page B2-358. 

e B2.8 AArch64 Address translation operations on page B2-359. 

¢ B2.9 AArch64 Miscellaneous operations on page B2-360. 

e B2.10 AArch64 Performance monitor registers on page B2-361. 

e B2.11 AArch64 Reset registers on page B2-363. 

e B2.12 AArch64 Secure registers on page B2-364. 

e B2.13 AArch64 Virtualization registers on page B2-365. 

e B2.14 AArch64 EL2 TLB maintenance operations on page B2-367. 
¢ B2.15 AArch64 GIC system registers on page B2-368. 

¢ B2.16 AArch64 Generic Timer registers on page B2-370. 

¢ B2.17 AArch64 Thread registers on page B2-371. 

e B2.18 AArch64 Implementation defined registers on page B2-372. 
e B2.19 Auxiliary Control Register, ELI] on page B2-374. 

e B2.20 Auxiliary Control Register, EL2 on page B2-375. 

e B2.21 Auxiliary Control Register, EL3 on page B2-377. 

e B2.22 Auxiliary Fault Status Register 0, ELI, EL2, and EL3 on page B2-379. 
e B2.23 Auxiliary Fault Status Register 1, EL1, EL2, and EL3 on page B2-380. 
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B2 AArch64 system registers 


e B2.24 Auxiliary ID Register, EL] on page B2-381. 

e B2.25 Auxiliary Memory Attribute Indirection Register, EL] on page B2-382. 
e B2.26 Auxiliary Memory Attribute Indirection Register, EL2 on page B2-383. 
¢ B2.27 Auxiliary Memory Attribute Indirection Register, EL3 on page B2-384. 
e B2.28 Configuration Base Address Register, EL] on page B2-385. 

e B2.29 Cache Size ID Register, ELI on page B2-386. 

e B2.30 Cache Level ID Register, ELI on page B2-388. 

¢ 82.31 Architectural Feature Access Control Register, EL] on page B2-390. 
¢ 82.32 Architectural Feature Trap Register, EL2 on page B2-392. 

¢ B2.33 Architectural Feature Trap Register, EL3 on page B2-394. 

e B2.34 Cache Size Selection Register, EL] on page B2-396. 

e B2.35 Cache Type Register, ELO on page B2-398. 

e B2.36 CPU Auxiliary Control Register, ELI on page B2-400. 

e B2.37 CPU Extended Control Register, ELI on page B2-404. 

e B2.38 CPU Memory Error Syndrome Register, ELI on page B2-406. 

¢ B2.39 Domain Access Control Register, EL2 on page B2-409. 

¢ B2.40 Data Cache Zero ID Register, ELO on page B2-410. 

e B2.41 Exception Syndrome Register, EL] on page B2-411. 

e B2.42 Exception Syndrome Register, EL2 on page B2-413. 

e B2.43 Exception Syndrome Register, EL3 on page B2-415. 

¢ B2.44 Fault Address Register, EL] on page B2-417. 

¢ B2.45 Fault Address Register, EL2 on page B2-418. 

¢ B2.46 Fault Address Register, EL3 on page B2-419. 

e B2.47 Hyp Auxiliary Configuration Register, EL2 on page B2-420. 

e B2.48 Hypervisor Configuration Register, EL2 on page B2-421. 

e B2.49 Hypervisor IPA Fault Address Register, EL2 on page B2-427. 

* B2.50 Hyp System Trap Register, EL2 on page B2-428. 

e B2.51 AArch64 Debug Feature Register 0, ELI on page B2-431. 

e B2.52 AArch64 Instruction Set Attribute Register 0, ELI on page B2-433. 

¢ B2.53 AArch64 Memory Model Feature Register 0, EL] on page B2-435. 

¢ B2.54 AArch64 Processor Feature Register 0, ELI on page B2-437. 

e B2.55 AArch32 Auxiliary Feature Register 0, ELI on page B2-439. 

e B2.56 AArch32 Debug Feature Register 0, ELI on page B2-440. 

e B2.57 AArch32 Instruction Set Attribute Register 0, ELI on page B2-442. 

e B2.58 AArch32 Instruction Set Attribute Register 1, EL] on page B2-444. 

¢ B2.59 AArch32 Instruction Set Attribute Register 2, ELI on page B2-446. 

¢ B2.60 AArch32 Instruction Set Attribute Register 3, EL] on page B2-448. 

¢ B2.61 AArch32 Instruction Set Attribute Register 4, ELI on page B2-450. 

e B2.62 AArch32 Instruction Set Attribute Register 5, ELI on page B2-452. 

¢ B2.63 AArch32 Memory Model Feature Register 0, EL] on page B2-454. 

¢ B2.64 AArch32 Memory Model Feature Register 1, EL] on page B2-456. 

¢ B2.65 AArch32 Memory Model Feature Register 2, EL] on page B2-458. 

¢ B2.66 AArch32 Memory Model Feature Register 3, EL] on page B2-460. 

¢ B2.67 AArch32 Processor Feature Register 0, ELI on page B2-462. 

¢ B2.68 AArch32 Processor Feature Register 1, ELI on page B2-463. 

¢ B2.69 Instruction Fault Status Register, EL2 on page B2-465. 

e B2.70 IFSR32_EL2 with Short-descriptor translation table format on page B2-466. 
e B2.71 IFSR32_EL2 with Long-descriptor translation table format on page B2-467. 
e B2.72 Interrupt Status Register, EL] on page B2-469. 

e B2.73 L2 Auxiliary Control Register, ELI on page B2-470. 

e B2.74 L2 Control Register, EL] on page B2-472. 

¢ B2.75 L2 Extended Control Register, ELI on page B2-474. 

e B2.76 L2 Memory Error Syndrome Register, ELI on page B2-476. 

¢ B2.77 Memory Attribute Indirection Register, ELI on page B2-479. 

¢ B2.78 Memory Attribute Indirection Register, EL2 on page B2-481. 

¢ B2.79 Memory Attribute Indirection Register, EL3 on page B2-482. 
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B2 AArch64 system registers 


¢ B2.80 Monitor Debug Configuration Register, EL2 on page B2-483. 
e B2.81 Monitor Debug Configuration Register, EL3 on page B2-486. 
e B2.82 Monitor Debug System Control Register, ELI on page B2-489. 
e B2.83 Main ID Register, EL] on page B2-492. 

¢ B2.84 Multiprocessor Affinity Register, ELI on page B2-494. 

e B2.85 Physical Address Register, EL] on page B2-496. 

e B2.86 Revision ID Register, ELI on page B2-499. 

e B2.87 Reset Management Register, EL3 on page B2-500. 

e B2.88 Reset Vector Base Address Register, EL3 on page B2-502. 

¢ B2.89 Secure Configuration Register, EL3 on page B2-503. 

e B2.90 System Control Register, ELI on page B2-506. 

e B2.91 System Control Register, EL2 on page B2-510. 

e B2.92 System Control Register, EL3 on page B2-512. 

e B2.93 Secure Debug Enable Register, EL3 on page B2-514. 

¢ B2.94 Translation Control Register, ELI on page B2-515. 

¢ B2.95 Translation Control Register, EL2 on page B2-519. 

¢ B2.96 Translation Control Register, EL3 on page B2-521. 

¢ B2.97 Translation Table Base Register 0, EL] on page B2-523. 

¢ B2.98 Translation Table Base Register 1, EL] on page B2-524. 

¢ B2.99 Translation Table Base Register 0, EL3 on page B2-525. 

¢ 82.100 Vector Base Address Register, ELI on page B2-526. 

¢ B2.101 Vector Base Address Register, EL2 on page B2-527. 

e B2.102 Vector Base Address Register, EL3 on page B2-528. 

¢ B2.103 Virtualization Multiprocessor ID Register, EL2 on page B2-529. 
¢ 82.104 Virtualization Processor ID Register, EL2 on page B2-530. 

¢ 82.105 Virtualization Translation Control Register, EL2 on page B2-531. 
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B2 AArch64 system registers 
B2.1 AArch64 register summary 


B2.1 AArch64 register summary 
This section gives a summary of the system registers in the AArch64 Execution state. 


For more information on using the system registers, see the ARM® Architecture Reference Manual 
ARMV8, for ARMv8-A architecture profile. 


The following subsections describe the system registers by functional group: 
e B2.2 AArch64 Identification registers on page B2-351. 

e B2.3 AArch64 Exception handling registers on page B2-353. 

e B2.4 AArch64 Virtual memory control registers on page B2-354. 

e B2.5 AArch64 Other System control registers on page B2-356. 

¢ B2.6 AArch64 Cache maintenance operations on page B2-357. 

e B2.7 AArch64 TLB maintenance operations on page B2-358. 

e B2.8 AArch64 Address translation operations on page B2-359. 

¢ B2.9 AArch64 Miscellaneous operations on page B2-360. 

¢« B2.10 AArch64 Performance monitor registers on page B2-361. 

e B2.11 AArch64 Reset registers on page B2-363. 

e B2.12 AArch64 Secure registers on page B2-364. 

e B2.13 AArch64 Virtualization registers on page B2-365. 

e B2.14 AArch64 EL2 TLB maintenance operations on page B2-367. 
¢ B2.15 AArch64 GIC system registers on page B2-368. 

¢ B2.16 AArch64 Generic Timer registers on page B2-370. 

¢ B2.17 AArch64 Thread registers on page B2-371. 

e B2.18 AArch64 Implementation defined registers on page B2-372. 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B2-350 
reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.2 AArch64 Identification registers 


B2.2 AArché64 Identification registers 


The following table shows the identification registers in AArch64 state. 


Bits[63:32] are reset to 0x90000000 for all 64-bit registers in the table. 


Table B2-1 AArch64 identification registers 











Name Type | Reset Width | Description 
MIDR EL1 RO | 0x410FD@42 | 32 B2.83 Main ID Register, EL] on page B2-492 
MPIDR_ EL1 RO |- 64 B2.84 Multiprocessor Affinity Register, ELI on page B2-494 


The reset value depends on the primary inputs, CLUSTERIDAFF1 and 
CLUSTERIDAFF7, and the number of cores that the device implements. 











REVIDR ELI RO _ | 0x89000008O | 32 B2.86 Revision ID Register, ELI] on page B2-499 
ID_PFRO EL1 RO | 0x00000131 | 32 B2.67 AArch32 Processor Feature Register 0, EL1 on page B2-462 
ID_PFR1_EL1 RO | 0x10011011 | 32 B2.68 AArch32 Processor Feature Register 1, EL1 on page B2-463 


Bits [31:28] are @x1 if the GIC CPU interface is present and enabled, and 
@x@ otherwise. 





ID_DFRO EL1 RO | 0x@3010066 | 32 B2.56 AArch32 Debug Feature Register 0, ELI] on page B2-440 


Bits [19:16] are @x1 if ETM is implemented, and @x@ otherwise. 



































ID_AFRO ELI RO _ | 0x89000008O | 32 B2.55 AArch32 Auxiliary Feature Register 0, EL] on page B2-439 

ID_MMFRO_ EL1 RO | 0x102011@5 | 32 B2.63 AArch32 Memory Model Feature Register 0, EL1 on page B2-454 
ID_MMFRI1 EL1 RO | 0x400000880 | 32 B2.64 AArch32 Memory Model Feature Register 1, EL1 on page B2-456 
ID_MMFR2 EL1 RO | 0x012600@80 | 32 B2.65 AArch32 Memory Model Feature Register 2, EL1 on page B2-458 
ID_MMFR3_ EL1 RO | @x@2102211 | 32 B2.66 AArch32 Memory Model Feature Register 3, EL1 on page B2-460 
ID_ISARO_EL1 RO | 0x@2101110 | 32 B2.57 AArch32 Instruction Set Attribute Register 0, ELI on page B2-442 
ID_ISAR1 ELI RO | 0x13112111 | 32 B2.58 AArch32 Instruction Set Attribute Register 1, EL] on page B2-444 
ID_ISAR2 EL1 RO | 0x21232042 | 32 B2.59 AArch32 Instruction Set Attribute Register 2, EL] on page B2-446 
ID_ISAR3_ EL] RO | 0x@1112131 | 32 B2.60 AArch32 Instruction Set Attribute Register 3, EL] on page B2-448 
ID_ISAR4 EL] RO | 0x00011142 | 32 B2.61 AArch32 Instruction Set Attribute Register 4, EL] on page B2-450 
ID_ISARS_EL1 RO | 0x90011121 | 32 B2.62 AArch32 Instruction Set Attribute Register 5, EL] on page B2-452 


ID_ISARS_EL1 has the value 0x00010001 if the Cryptographic Extension 
is not implemented and enabled. 





ID_AA64PFRO_ EL1 RO | 0x01002222 | 64 B2.54 AArch64 Processor Feature Register 0, EL1 on page B2-437 


Bits [27:24] are @x1 if the GIC CPU interface is present and enabled, and 
@x® otherwise. 


Bits [23:16] are @x@@ if the Advanced SIMD and floating-point support is 
implemented, and @xFF otherwise. 





ID_AA64PFR1 ELI] RO | 0x00000000 | 64 AArch64 Processor Feature Register 1 





ID_AA64DFRO EL1 RO | 0x10305106 | 64 B2.51 AArch64 Debug Feature Register 0, EL] on page B2-431 























ID_AA64DFR1 _EL1 RO | 0x000008880 | 64 AArch64 Debug Feature Register 1 
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B2 AArch64 system registers 
B2.2 AArch64 Identification registers 


Table B2-1 AArch64 identification registers (continued) 





Name Type | Reset Width | Description 





ID_AA64AFRO EL1 RO | 0x000008080 | 64 AArch64 Auxiliary Feature Register 0 





ID_AA64AFR1 EL1 RO | 0x000000880 | 64 AArch64 Auxiliary Feature Register 1 





ID_AA64ISARO ELI |RO_ | 0x00011120 | 64 B2.52 AArch64 Instruction Set Attribute Register 0, EL] on page B2-433 


ID_AA64ISARO_EL1 has the value 0x00010000 if the Cryptographic 
Extension is not implemented and enabled. 





ID_AA64ISARI_ EL1 |RO | 0x00000000 | 64 AArch64 Instruction Set Attribute Register 1 





ID_AA64MMFRO_ ELI |RO | 0x00101122 | 64 B2.53 AArch64 Memory Model Feature Register 0, EL1 on page B2-435 





ID_AA64MMFRI1 _EL1|RO_ | 0x00000000 | 64 AArch64 Memory Model Feature Register 1 








CCSIDR_EL1 RO |J- 32 B2.29 Cache Size ID Register, EL] on page B2-386 
The reset value depends on the implementation. See the register description 
for details. 

CLIDR_EL1 RO | 0x0A400@23 | 64 B2.30 Cache Level ID Register, EL] on page B2-388 


The reset value is 0x09200003 if the L2 cache is not implemented. 


The reset value is @x@A200023 if the L2 cache is implemented and 
BROADCASTINNER is set to 0. 


The reset value is @x@A400023 if the L2 cache is implemented and 
BROADCASTINNER is set to 1. 




















AIDR_EL1 RO | 0x89000008O | 32 B2.24 Auxiliary ID Register, EL] on page B2-381 

CSSELR_EL1 RW _ | 0x000000880 | 32 B2.34 Cache Size Selection Register, EL1 on page B2-396 

CTR_ELO RO | 0x84448004 | 32 B2.35 Cache Type Register, ELO on page B2-398 

DCZID_ELO RO | 0x00000004 | 32 B2.40 Data Cache Zero ID Register, ELO on page B2-410 
VPIDR_EL2 RW | 0x410FD@42 | 32 B2.104 Virtualization Processor ID Register, EL2 on page B2-530 
VMPIDR_EL2 RO |J- 64 B2.103 Virtualization Multiprocessor ID Register, EL2 on page B2-529 


The reset value is the value of the Multiprocessor Affinity Register. 
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B2 AArch64 system registers 
B2.3 AArch64 Exception handling registers 



























































B2.3 AArch64 Exception handling registers 
The following table shows the fault handling registers in AArch64 state. 
Bits[63:32] are reset to 0x90000000 for all 64-bit registers in the table. 
Table B2-2 AArch64 exception handling registers 
Name Type | Reset Width | Description 
AFSRO_EL1 |RW_ |@0x00000000 32 B2.22 Auxiliary Fault Status Register 0, EL1, EL2, and EL3 on page B2-379 
AFSR1_EL1 |RW_ |@0x00000000 32 B2.23 Auxiliary Fault Status Register 1, EL1, EL2, and EL3 on page B2-380 
ESR _EL1 RW |UNK 32 B2.41 Exception Syndrome Register, EL1 on page B2-411 
IFSR32_EL2 |RW | UNK 32 B2.69 Instruction Fault Status Register, EL2 on page B2-465 
AFSRO_EL2 |RW_ |©0x00000000 32 B2.22 Auxiliary Fault Status Register 0, EL1, EL2, and EL3 on page B2-379 
AFSR1_EL2 |RW_ |@0x00000000 32 B2.23 Auxiliary Fault Status Register 1, EL1, EL2, and EL3 on page B2-380 
ESR_EL2 RW |UNK 32 B2.42 Exception Syndrome Register, EL2 on page B2-413 
AFSRO_EL3 |RW_ |@0x00000000 32 B2.22 Auxiliary Fault Status Register 0, EL1, EL2, and EL3 on page B2-379 
AFSR1_EL3 |RW_ |@0x00000000 32 B2.23 Auxiliary Fault Status Register 1, EL1, EL2, and EL3 on page B2-380 
ESR_EL3 RW |UNK 32 B2.43 Exception Syndrome Register, EL3 on page B2-415 
FAR ELI] RW |UNK 64 B2.44 Fault Address Register, ELI on page B2-417 
FAR _EL2 RW |UNK 64 B2.45 Fault Address Register, EL2 on page B2-418 
HPFAR_EL2|RW_ | 0x80000000000000080 | 64 B2.49 Hypervisor IPA Fault Address Register, EL2 on page B2-427 
FAR_EL3 RW |UNK 64 B2.46 Fault Address Register, EL3 on page B2-419 
VBAR ELI RW | UNK 64 B2.100 Vector Base Address Register, EL] on page B2-526 
ISR_EL1 RO |UNK 32 B2.72 Interrupt Status Register, ELI on page B2-469 
VBAR_EL2 |RW | UNK 64 B2.101 Vector Base Address Register, EL2 on page B2-527 
VBAR EL3 |RW | UNK 64 B2.102 Vector Base Address Register, EL3 on page B2-528 



































ARM 100236_0002_00_en 


Copyright © 2015-2017 ARM Limited or its affiliates. All rights 


B2-353 
reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.4 AArch64 Virtual memory control registers 
























































B2.4 AArch64 Virtual memory control registers 
The following table shows the virtual memory control registers in AArch64 state. 
Bits[63:32] are reset to 0x90000000 for all 64-bit registers in the table. 
Table B2-3 AArch64 virtual memory control registers 
Name Type | Reset Width | Description 
SCTLR_EL1 RW _ | 0x00C50838 32 B2.90 System Control Register, EL1 on page B2-506 
The reset value depends on primary inputs CFGTE and CFGEND. 
The value listed here assumes these signals are LOW. 
SCTLR_EL2 RW | 0x30C50838 32 B2.91 System Control Register, EL2 on page B2-510 
The reset value depends on primary inputs CFGTE, CFGEND and 
VINITHI. The value listed here assumes these signals are LOW. 
SCTLR_EL3 RW | 0x@0C50838 32 B2.92 System Control Register, EL3 on page B2-512 
The reset value depends on primary inputs CFGTE, CFGEND and 
VINITHI. The value listed here assumes these signals are LOW. 
TTBRO_EL1 RW | UNK 64 B2.97 Translation Table Base Register 0, ELI on page B2-523 
TTBR1_EL1 RW |UNK 64 B2.98 Translation Table Base Register 1, EL] on page B2-524 
TCR_EL1 RW |UNK 64 B2.94 Translation Control Register, EL] on page B2-515 
TTBRO_EL2 RW |UNK 64 Translation Table Base Address Register 0, EL2 
See the ARM" Architecture Reference Manual ARMVv8, for ARMv8s-A 
architecture profile. 
TCR_EL2 RW |UNK 32 B2.95 Translation Control Register, EL2 on page B2-519 
VTTBR_EL2 RW |UNK 64 Virtualization Translation Table Base Address Register, EL2 
See the ARM® Architecture Reference Manual ARMVv8, for ARMv8s-A 
architecture profile. 
VTCR_EL2 RW |UNK 32 B2.105 Virtualization Translation Control Register, EL2 
on page B2-531 
TTBRO_EL3 RW | UNK 64 B2.99 Translation Table Base Register 0, EL3 on page B2-525 
TCR_EL3 RW |UNK 32 B2.96 Translation Control Register, EL3 on page B2-521 
MAIR EL1 RW | UNK 64 B2.77 Memory Attribute Indirection Register, EL] on page B2-479 
AMAIR_EL1 RW |@0x000000000000000O | 64 B2.25 Auxiliary Memory Attribute Indirection Register, EL1 
on page B2-382 
MAIR EL2 RW |UNK 64 B2.78 Memory Attribute Indirection Register, EL2 on page B2-481 
AMAIR EL2 RW |@0x0000000000000000 | 64 B2.26 Auxiliary Memory Attribute Indirection Register, EL2 
on page B2-383 
MAIR EL3 RW | UNK 64 B2.79 Memory Attribute Indirection Register, EL3 on page B2-482 
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B2 AArch64 system registers 
B2.4 AArch64 Virtual memory control registers 


Table B2-3 AArch64 virtual memory control registers (continued) 














Name Type | Reset Width | Description 

AMAIR EL3 RW |@0x0000000000000000 | 64 B2.27 Auxiliary Memory Attribute Indirection Register, EL3 
on page B2-384 

CONTEXTIDR EL1)]RW | UNK 32 Context ID Register, EL1 








architecture profile. 








See the ARM” Architecture Reference Manual ARMVv8, for ARMv8s-A 
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B2 AArch64 system registers 
B2.5 AArch64 Other System control registers 


B2.5 AArch64 Other System control registers 


The following table shows the other system control registers in AArch64 state. 


Table B2-4 AArch64 other system control registers 
































Name Type | Reset Width | Description 

ACTLR_EL1|RW_ | 0x000000080 | 32 B2.19 Auxiliary Control Register, EL] on page B2-374 

CPACR_EL1 | RW_ | 0x000000@0 | 32 B2.31 Architectural Feature Access Control Register, EL] on page B2-390 
ACTLR_EL2|RW_ |@0x00000000 | 32 B2.20 Auxiliary Control Register, EL2 on page B2-375 
ACTLR_EL3|RW_ | 0x00000000 | 32 B2.21 Auxiliary Control Register, EL3 on page B2-377 
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B2 AArch64 system registers 
B2.6 AArch64 Cache maintenance operations 





















































B2.6 AArch64 Cache maintenance operations 
The following table shows the System instructions for cache and maintenance operations in AArch64 
state. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about these operations. 
Table B2-5 AArch64 cache maintenance operations 
Name Description 
IC IALLUTS | Instruction cache invalidate all to PoU Inner Shareable 
PoU = Point of Unification. PoU is set by the BROADCASTINNER signal and can be in the L1 data cache or outside 
of the processor, in which case PoU is dependent on the external memory system. 
Ic IALLU Instruction cache invalidate all to PoU 
Ic IVAU Instruction cache invalidate by virtual address (VA) to PoU 
DC IVAC Data cache invalidate by VA to PoC 
PoC = Point of Coherence. The PoC is always outside of the processor and depends on the external memory system. 
DC ISW Data cache invalidate by set/way 
DC CSW Data cache clean by set/way 
DC CISW Data cache clean and invalidate by set/way 
DC ZVA Data cache zero by VA 
DC CVAC Data cache clean by VA to PoC 
DC CVAU Data cache clean by VA to PoU 
DC CIVAC Data cache clean and invalidate by VA to PoC 
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B2 AArch64 system registers 
B2.7 AArch64 TLB maintenance operations 
























































B2.7 AArch64 TLB maintenance operations 
The following table shows the System instructions for TLB maintenance operations in AArch64 state. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about these operations. 
Table B2-6 AArch64 TLB maintenance operations 
Name Description 
TLBI VMALLE1TS | Invalidate all stage 1 translations used at EL1 with the current virtual machine identifier (VMID) in the Inner 
Shareable 
TLBI VAE1IS Invalidate translation used at EL1 for the specified VA and Address Space Identifier (ASID) and the current 
VMID, Inner Shareable 
TLBI ASIDE1IS | Invalidate all translations used at EL1 with the current VMID and the supplied ASID, Inner Shareable 
TLBI VAAE1IS Invalidate all translations used at EL1 for the specified address and current VMID and for all ASID values, Inner 
Shareable 
TLBI VALE1IS Invalidate all entries from the last level of stage 1 translation table walk used at EL1 with the supplied ASID and 
current VMID, Inner Shareable 
TLBI VAALE1IS | Invalidate all entries from the last level of stage 1 translation table walk used at EL1 for the specified address and 
current VMID and for all ASID values, Inner Shareable 
TLBI VMALLE1 Invalidate all stage 1 translations used at EL1 with the current VMID 
TLBI VAE1 Invalidate translation used at EL1 for the specified VA and ASID and the current VMID 
TLBI ASIDE1 Invalidate all translations used at EL1 with the current VMID and the supplied ASID 
TLBI VAAE1 Invalidate all translations used at EL1 for the specified address and current VMID and for all ASID values 
TLBI VALE1 Invalidate all entries from the last level of stage 1 translation table walk used at EL1 with the supplied ASID and 
current VMID 
TLBI VAALE1 Invalidate all entries from the last level of stage 1 translation table walk used at EL1 for the specified address and 
current VMID and for all ASID values 
The Virtualization registers include additional TLB operations for use in Hyp mode. For more 
information, see B2.14 AArch64 EL2 TLB maintenance operations on page B2-367. 
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B2.8 AArch64 Address translation operations 


B2 AArch64 system registers 
B2.8 AArch64 Address translation operations 


The following table shows the address translation register in AArch64 state. 


Table B2-7 AArch64 address translation register 





Name Type | Reset 


Width 


Description 





PAR EL1}RW |UNK 











64 





B2.85 Physical Address Register, EL1 on page B2-496 








The following table shows the System instructions for address translation operations in AArch64 state. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
























































information. 

Table B2-8 AArch64 address translation operations 
Name Description 
AT S1E1R | Stage 1 current state EL1 read 
AT S1E1W | Stage 1 current state EL1 write 
AT S1E®R | Stage 1 current state unprivileged read 
AT S1E@W | Stage 1 current state unprivileged write 
AT S1E2R | Stage 1 Hyp mode read 
AT S1E2W | Stage 1 Hyp mode write 
AT S12E1R | Stages 1 and 2 Non-secure EL1 read 
AT S12E1W | Stages 1 and 2 Non-secure EL1 write 
AT S12E@R | Stages 1 and 2 Non-secure unprivileged read 
AT S12E@W | Stages 1 and 2 Non-secure unprivileged write 
AT S1E3R | Stage 1 current state EL3 read 
AT S1E3W | Stage 1 current state EL3 write 
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B2.9 AArch64 Miscellaneous operations 


B2 AArch64 system registers 
B2.9 AArch64 Miscellaneous operations 


The following table shows the miscellaneous operations in AArch64 state. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 


information about these operations. 


Table B2-9 AArch64 miscellaneous system operations 









































Name Type Reset | Width | Description 

TPIDR_ELO RW UNK |64 Thread Pointer / ID Register, ELO 

TPIDR_EL1 RW UNK |64 Thread Pointer / ID Register, EL1 

TPIDRRO_ELO0 | RW UNK |64 Thread Pointer / ID Register, read-only, ELO 
RO at ELO. 

TPIDR_EL2 RW UNK |64 Thread Pointer / ID Register, EL2 

TPIDR_EL3 RW UNK |64 Thread Pointer / ID Register, EL3 











ARM 100236_0002_00_en 


Copyright © 2015-2017 ARM Limited or its affiliates. All rights 


reserved. 
Non-Confidential 


B2-360 


B2 AArch64 system registers 
B2.10 AArch64 Performance monitor registers 


B2.10 AArch64 Performance monitor registers 
The following table shows the performance monitor registers in AArch64 state. 


Bits[63:32] are reset to 0x90000000 for all 64-bit registers in the table. 


Table B2-10 AArch64 performance monitor registers 











Name Type | Reset Width | Description 
PMCR_ELO RW _ | 0x410A30@0 | 32 C10.6 Performance Monitors Control Register, ELO on page C10-674 
PMCNTENSET ELO | RW | UNK 32 Performance Monitors Count Enable Set Register 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8s-A 
architecture profile for more information. 





PMCNTENCLR_ELO|RW_ | UNK 32 Performance Monitors Count Enable Clear Register 


See the ARM” Architecture Reference Manual ARMV6, for ARMv8-A 
architecture profile for more information. 





PMOVSCLR_ELO RW |UNK 32 Performance Monitors Overflow Flag Status Clear Register 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8s-A 
architecture profile for more information. 





PMSWINC ELO WO |- 32 Performance Monitors Software Increment Register 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A 
architecture profile for more information. 





PMSELR_ELO RW |UNK 32 Performance Monitors Event Counter Selection Register 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A 
architecture profile for more information. 





PMCEIDO_ELO RO | OxX6FFFBFFF | 32 C10.7 Performance Monitors Common Event Identification Register 0, ELO 
on page C10-677 


The reset value is @X6E3FBFFF if the Cortex-A35 processor has not been 
configured with an L2 cache. 





PMCEID1_ ELO RO | 0x000000880 | 32 C10.8 Performance Monitors Common Event Identification Register 1, ELO 
on page C10-681 


See the ARM® Architecture Reference Manual ARMVv6, for ARMv8-A 
architecture profile for more information. 





PMCCNTR_ELO RW |UNK 64 Performance Monitors Cycle Counter 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A 
architecture profile for more information. 





PMXEVTYPER EL0 |RW | UNK 32 Performance Monitors Selected Event Type and Filter Register 


See the ARM® Architecture Reference Manual ARMVv6, for ARMv8-A 
architecture profile for more information. 





PMXEVCNTR ELO |RW | UNK 32 Performance Monitors Selected Event Counter Register 


See the ARM® Architecture Reference Manual ARMVv6, for ARMv8s-A 
architecture profile for more information. 
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B2 AArch64 system registers 
B2.10 AArch64 Performance monitor registers 


Table B2-10 AArch64 performance monitor registers (continued) 




























































































Name Type | Reset Width | Description 

PMUSERENR ELO |RW_ | 0x000000@0 | 32 Performance Monitors User Enable Register 
See the ARM® Architecture Reference Manual ARMVv6, for ARMv8-A 
architecture profile for more information. 

PMINTENSET ELI |RW | UNK 32 Performance Monitors Interrupt Enable Set Register 
See the ARM” Architecture Reference Manual ARMVv6, for ARMv8s-A 
architecture profile for more information. 

PMINTENCLR ELI] |RW | UNK 32 Performance Monitors Interrupt Enable Clear Register 
See the ARM® Architecture Reference Manual ARMVv6, for ARMv8-A 
architecture profile for more information. 

PMOVSSET_ELO RW |UNK 32 Performance Monitors Overflow Flag Status Set Register 
See the ARM® Architecture Reference Manual ARMVv6, for ARMv8-A 
architecture profile for more information. 

PMEVCNTRO ELO |RW_ | UNK 32 Performance Monitor Event Count Registers 

PMEVCNTRI ELO |RW | UNK 32 

PMEVCNTR2 ELO |RW | UNK 32 

PMEVCNTR3 ELO |RW | UNK 32 

PMEVCNTR4 ELO | RW | UNK 32 

PMEVCNTRS ELO |RW | UNK 32 

PMEVTYPERO ELO |RW | UNK 32 Performance Monitor Event Type Registers 

PMEVTYPERI ELO |RW | UNK 32 

PMEVTYPER2 ELO |RW | UNK 32 

PMEVTYPER3 ELO |RW | UNK 32 

PMEVTYPER4 ELO |RW | UNK 32 

PMEVTYPERS ELO |RW | UNK 32 

PMCCFILTR_ELO RW | 0x000000880 | 32 Performance Monitors Cycle Count Filter Register 


See the ARM® Architecture Reference Manual ARMVv6, for ARMv8s-A 
architecture profile for more information. 
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B2.11 AArch64 Reset registers 
The following table shows the reset registers in AArch64 state. 


B2 AArch64 system registers 
B2.11 AArch64 Reset registers 


Table B2-11 AArch64 reset management registers 


























Name Type | Reset Width | Description 

RVBAR EL3|/RO_ |- 64 B2.88 Reset Vector Base Address Register, EL3 on page B2-502 
The reset value depends on the RVBARADDR signal. 

RMR _EL3 RW_ | 0x000000@1 | 32 B2.87 Reset Management Register, EL3 on page B2-500 
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B2 AArch64 system registers 
B2.12 AArch64 Secure registers 


























B2.12 AArch64 Secure registers 
The following table shows the secure registers in AArch64 state. 
Table B2-12 AArch64 security registers 
Name Type | Reset Width | Description 
SCR_EL3 RW | 0x000000880 | 32 B2.89 Secure Configuration Register, EL3 on page B2-503 
SDER32_EL3|}RW_ | 0x000000@80 | 32 B2.93 Secure Debug Enable Register, EL3 on page B2-514 
CPTR_EL3 RW _ | 0x000000880 | 32 B2.33 Architectural Feature Trap Register, EL3 on page B2-394 
Reset value is 0x00000000 if Advanced SIMD and floating- point are implemented, 
0x00000400 otherwise. 
MDCR_EL3 |RW_ |@0x00000000 | 32 B2.81 Monitor Debug Configuration Register, EL3 on page B2-486 
AFSRO_EL3 |RW_ | 0x00000000 | 32 B2.22 Auxiliary Fault Status Register 0, ELI, EL2, and EL3 on page B2-379 
AFSR1_EL3 |RW_ | 0x00000000 | 32 B2.23 Auxiliary Fault Status Register 1, ELI, EL2, and EL3 on page B2-380 
VBAR EL3 | RW | UNK 64 B2.102 Vector Base Address Register, EL3 on page B2-528 
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B2 AArch64 system registers 
B2.13 AArch64 Virtualization registers 

































































B2.13 AArch64 Virtualization registers 
The following table shows the virtualization registers in AArch64 state. 
Bits[63:32] are reset to 0x90000000 for all 64-bit registers in this table. 
Table B2-13 AArch64 virtualization registers 

Name Type | Reset Width | Description 

VPIDR_EL2 |RW_ | 0x410FD042 32 B2.104 Virtualization Processor ID Register, EL2 on page B2-530 

VMPIDR _EL2|RW |- 64 B2.103 Virtualization Multiprocessor ID Register, EL2 on page B2-529 
The reset value is the value of the Multiprocessor Affinity Register. 

SCTLR_EL2 |RW_ | 0x30C50838 32 B2.91 System Control Register, EL2 on page B2-510 
The reset value depends on inputs, CFGTE and CFGEND. The value 
shown assumes these signals are set to LOW. 

ACTLR_EL2 |RW_ | 0xeee00000 32 B2.20 Auxiliary Control Register, EL2 on page B2-375 

HCR_EL2 RW _| 0x0000000000000002 | 64 B2.48 Hypervisor Configuration Register, EL2 on page B2-421 

MDCR_EL2 |RW_ | 0xe0e000006 32 B2.80 Monitor Debug Configuration Register, EL2 on page B2-483 

CPTR_EL2 RW | 0x@00033FF 32 B2.32 Architectural Feature Trap Register, EL2 on page B2-392 
The reset value is @xOQOOBFFF if Advanced SIMD and floating-point are 
not implemented. 

HSTR_EL2 RW_ |@0x00000000 32 B2.50 Hyp System Trap Register, EL2 on page B2-428 

HACR_EL2 RW |@0x00000000 32 B2.47 Hyp Auxiliary Configuration Register, EL2 on page B2-420 

TTBRO_EL2 |RW |UNK 64 Translation Table Base Address Register 0, EL3 
See the ARM® Architecture Reference Manual ARMv6, for ARMv8-A 
architecture profile for more information. 

TCR_EL2 RW |UNK 32 B2.95 Translation Control Register, EL2 on page B2-519 

VTTBR EL2 |RW | UNK 64 Virtualization Translation Table Base Address Register, EL2 
See the ARM® Architecture Reference Manual ARMv6, for ARMv8-A 
architecture profile. 

VTCR_EL2 RW |UNK 32 B2.105 Virtualization Translation Control Register, EL2 on page B2-531 

DACR32_EL2 |RW | UNK 32 B2.39 Domain Access Control Register, EL2 on page B2-409 

AFSRO_EL2 |RW_ |@0x00000000 32 B2.22 Auxiliary Fault Status Register 0, EL1, EL2, and EL3 
on page B2-379 

AFSR1_EL2 RW |@0x00000000 32 B2.23 Auxiliary Fault Status Register 1, EL1, EL2, and EL3 
on page B2-380 

ESR_EL2 RW |UNK 32 B2.42 Exception Syndrome Register, EL2 on page B2-413 

FAR _EL2 RW |UNK 64 B2.45 Fault Address Register, EL2 on page B2-418 

HPFAR EL2 |RW |UNK 64 B2.49 Hypervisor IPA Fault Address Register, EL2 on page B2-427 

MAIR EL2 RW |UNK 64 B2.78 Memory Attribute Indirection Register, EL2 on page B2-481 
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B2 AArch64 system registers 
B2.13 AArch64 Virtualization registers 


Table B2-13 AArch64 virtualization registers (continued) 





Name Type | Reset 


Width | Description 





AMAIR EL2 |RW_ | 0x80000000000000080 | 64 B2.26 Auxiliary Memory Attribute Indirection Register, EL2 


on page B2-383 





VBAR_EL2 RW |UNK 








64 B2.101 Vector Base Address Register, EL2 on page B2-527 
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B2 AArch64 system registers 
B2.14 AArch64 EL2 TLB maintenance operations 
















































































B2.14 AArch64 EL2 TLB maintenance operations 
The following table shows the System instructions for TLB maintenance operations added in AArch64 
state. 
See the ARM” Architecture Reference Manual ARMVv8, for ARMv8-A architecture profile for more 
information about these operations. 
Table B2-14 AArch64 TLB maintenance operations 
Name Description 
TLBI IPAS2E1IS Invalidate stage 2 only translations used at EL1 for the specified IPA for the current VMID, Inner Shareable 
TLBI IPAS2LE1IS Invalidate entries from the last level of stage 2 only translation used at EL1 for the specified IPA for the 
current VMID, Inner Shareable 
TLBI ALLE2IS Invalidate all stage 1 translations used at EL2, Inner Shareable 
TLBI VAE2IS Invalidate translation used at EL2 for the specified VA and ASID and the current VMID, Inner Shareable 
TLBI ALLE1IS Invalidate all stage 1 translations used at EL1, Inner Shareable 
TLBI VALE2IS Invalidate all entries from the last level of stage 1 translation table walk used at EL2 with the supplied ASID 
and current VMID, Inner Shareable 
TLBI VMALLS12E1IS | Invalidate all stage 1 and 2 translations used at EL1 with the current VMID, Inner Shareable 
TLBI IPAS2E1 Invalidate stage 2 only translations used at EL1 for the specified IPA for the current VMID 
TLBI IPAS2LE1 Invalidate entries from the last level of stage 2 only translation used at EL1 for the specified IPA for the 
current VMID 
TLBI ALLE2 Invalidate all stage 1 translations used at EL2 
TLBI VAE2 Invalidate translation used at EL2 for the specified VA and ASID and the current VMID 
TLBI ALLE1 Invalidate all stage 1 translations used at EL1 
TLBI VALE2 Invalidate all entries from the last level of stage 1 translation table walk used at EL2 with the supplied ASID 
and current VMID 
TLBI VMALLS12E1 Invalidate all stage 1 and 2 translations used at EL1 with the current VMID 
TLBI ALLE3IS Invalidate all stage 1 translations used at EL3, Inner Shareable 
TLBI VAE3IS Invalidate translation used at EL3 for the specified VA and ASID and the current VMID, Inner Shareable 
TLBI VALE3IS Invalidate all entries from the last level of stage 1 translation table walk used at EL3 with the supplied ASID 
and current VMID, Inner Shareable 
TLBI ALLE3 Invalidate all stage 1 translations used at EL3 
TLBI VAE3 Invalidate translation used at EL3 for the specified VA and ASID and the current VMID 
TLBI VALE3 Invalidate all entries from the last level of stage 1 translation table walk used at EL3 with the supplied ASID 
and current VMID 
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B2.15 AArch64 GIC system registers 


B2.15 AArch64 GIC system registers 


The following table shows the GIC system registers in AArch64 state. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 

















































































































information. 
Table B2-15 GIC system registers 
Name Type | Reset Width | Description 
ICC_APORO EL1 RW |@0x00000000 32 Active Priorities 0 Register 0 
ICC_AP1RO_ EL1 RW |@0x00000000 32 Active Priorities 1 Register 0 
ICC_ASGIIR_ELI {WO |- 64 Alternate SGI Generation Register 1 
ICC_BPRO EL1 RW |@0x00000002 32 Binary Point Register 0 
ICC _BPR1_EL1 RW |0x00000003 32 Binary Point Register 1 
This is the reset value in Non-secure states. In Secure states, the reset 
value is @x00000002. 
ICC_CTLR_EL1 RW |0x00000400 32 Interrupt Control Register for EL1 
ICC_CTLR_EL3 RW |0x00000400 32 Interrupt Control Register for EL3 
ICC_DIR_EL1 WoO |- 32 Deactivate Interrupt Register 
ICC_EOIRO_EL1 WO |- 32 End Of Interrupt Register 0 
ICC_EOIR1_EL1 WO |J- 32 End Of Interrupt Register 1 
ICC_HPPIRO ELI |RO_ |- 32 Highest Priority Pending Interrupt Register 0 
ICC_HPPIR1 ELI |RO |- 32 Highest Priority Pending Interrupt Register 1 
ICC_IARO EL1 RO |- 32 Interrupt Acknowledge Register 0 
ICC_IAR1_EL1 RO |- 32 Interrupt Acknowledge Register 1 
ICC _IGRPEN0 ELI |RW |@0x00000000 32 Interrupt Group Enable Register 0 
ICC_IGRPEN1 EL1|RW_ |@0x00000000 32 Interrupt Group Enable Register 1 
ICC_IGRPEN1 EL3|RW_ |@0x00000000 32 Interrupt Group Enable Register 1 for EL3 
ICC_PMR ELI RW |@0x00000000 32 Priority Mask Register 
ICC_RPR_EL1 RO |- 32 Running Priority Register 
ICC_SGIOR_EL1 WO |- 64 SGI Generation Register 0 
ICC_SGI1R_EL1 WO |- 64 SGI Generation Register 1 
ICC_SRE EL] RW |@0x00000000 32 System Register Enable Register for EL1 
ICC_SRE EL2 RW | 0xeee00000 32 System Register Enable Register for EL2 
ICC_SRE EL3 RW | 0xeeee00000 32 System Register Enable Register for EL3 
ICH_APORO_EL2 RW | 0xeeee00000 32 Interrupt Controller Hyp Active Priorities Register (0,0) 
ICH_AP1RO_ EL2 RW | 0xeeee00000 32 Interrupt Controller Hyp Active Priorities Register (1,0) 
ICH_EISR_EL2 RO | @xeeee0000 32 Interrupt Controller End of Interrupt Status Register 
ICH_ELRSR_EL2 |RO_ |@©0x0000000F 32 Interrupt Controller Empty List Register Status Register 
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B2 AArch64 system registers 
B2.15 AArch64 GIC system registers 


Table B2-15 GIC system registers (continued) 





























Name Type | Reset Width | Description 

ICH_HCR_EL2 RW |@0x00000000 32 Interrupt Controller Hyp Control Register 
ICH_LRO_EL2 RW _ | 0x0000000000000080 | 64 Interrupt Controller List Register 0 

ICH_LR1_EL2 RW |0x0000000000000000 | 64 Interrupt Controller List Register 1 

ICH_LR2_EL2 RW |0x000000000000000O | 64 Interrupt Controller List Register 2 

ICH_LR3_EL2 RW |0x0000000000000000 | 64 Interrupt Controller List Register 3 

ICH_MISR_EL2 RO | 0xeeee0000 32 Interrupt Controller Maintenance Interrupt State Register 
ICH_VMCR_EL2 RW |@0x004C0000 32 Interrupt Controller Virtual Machine Control Register 
ICH_VTR_EL2 RO | 0x90080003 32 Interrupt Controller VGIC Type Register 
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B2 AArch64 system registers 
B2.16 AArch64 Generic Timer registers 


B2.16 AArch64 Generic Timer registers 


The processor implements the architecturally defined Generic Timer registers. 


Related information 


e B4.3 AArch64 Generic Timer register summary on page B4-546. 
e ARM” Architecture Reference Manual ARMV8, for ARMV8-A architecture profile (ARM DDI 0487). 
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B2.17 AArch64 Thread registers 


The following table shows the thread registers in AArch64 state. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about these operations. 


B2 AArch64 system registers 
B2.17 AArch64 Thread registers 


Table B2-16 AArch64 miscellaneous system control operations 









































Name Type | Reset | Width | Description 

TPIDR_ELO RW |UNK | 64 Thread Pointer/ID Register, ELO 
TPIDR_EL1 RW |UNK | 64 Thread Pointer/ID Register, EL1 
TPIDRRO ELO|RW |UNK | 64 Thread Pointer/ID Register, read-only, ELO 
TPIDR_ EL2 RW |UNK | 64 Thread Pointer/ID Register, EL2 

TPIDR_ EL3 RW |UNK | 64 Thread Pointer/ID Register, EL3 











ARM 100236_0002_00_en 


reserved. 


Non-Confidential 


Copyright © 2015-2017 ARM Limited or its affiliates. All rights 


B2-371 


B2 AArch64 system registers 
B2.18 AArch64 Implementation defined registers 


B2.18 AArch64 Implementation defined registers 


IMPLEMENTATION DEFINED registers provide test features and any required configuration options specific to 
the Cortex-A35 processor. 


The following table shows the IMPLEMENTATION DEFINED registers in AArch64 state. If a register is not 
indicated as mapped to an AArch32 64-bit register, bits[63:32] are @xeeee00e0. 


Table B2-17 AArch64 implementation defined registers 

















Name Type | Reset Width | Description 

ACTLR ELI RW |@0x00000000 32 B2.19 Auxiliary Control Register, EL] on page B2-374 
ACTLR_EL2 RW |@0x00000000 32 B2.20 Auxiliary Control Register, EL2 on page B2-375 
ACTLR_EL3 RW |@0x00000000 32 B2.21 Auxiliary Control Register, EL3 on page B2-377 
AFSRO_EL1 RW |@0x00000000 32 B2.22 Auxiliary Fault Status Register 0, EL1, EL2, and EL3 


on page B2-379 





AFSR1_EL1 RW |@0x00000000 32 B2.23 Auxiliary Fault Status Register 1, EL1, EL2, and EL3 
on page B2-380 





AFSRO_EL2 RW |@0x00000000 32 B2.22 Auxiliary Fault Status Register 0, EL1, EL2, and EL3 
on page B2-379 





AFSR1_EL2 RW |@0x00000000 32 B2.23 Auxiliary Fault Status Register 1, EL1, EL2, and EL3 
on page B2-380 





AFSRO_EL3 RW |@0x00000000 32 B2.22 Auxiliary Fault Status Register 0, EL1, EL2, and EL3 
on page B2-379 





AFSR1_EL3 RW | 0xeee00000 32 B2.23 Auxiliary Fault Status Register 1, EL1, EL2, and EL3 
on page B2-380 





AMAIR EL1 RW | 0x00000000000000880 | 64 B2.25 Auxiliary Memory Attribute Indirection Register, EL1 
on page B2-382 





AMAIR_EL2 RW | 0x0@00000800000000880 | 64 B2.26 Auxiliary Memory Attribute Indirection Register, EL2 
on page B2-383 





AMAIR EL3 RW | 0x00000000000000880 | 64 B2.27 Auxiliary Memory Attribute Indirection Register, EL3 
on page B2-384 





L2CTLR_EL1 RW |- 32 B2.74 L2 Control Register, EL] on page B2-472 


The reset value depends on the processor implementation and the 
state of the LARSTDISABLE signal. 





L2ECTLR_EL1 RW |@0x00000000 32 B2.75 L2 Extended Control Register, ELI on page B2-474 





L2ACTLR_EL1 RW | 0x80000000 32 B2.73 L2 Auxiliary Control Register, ELI on page B2-470 


This is the reset value for an ACE interface. For an AXI interface the 
reset value is 0x 80000008. For a CHI interface the reset value is 
Q0x80004008. 





CPUACTLR_EL1 |RW_ | 0x00000000090CAQO@8 | 64 B2.36 CPU Auxiliary Control Register, EL1 on page B2-400 
Mapped to a 64-bit AArch32 register. 





CPUECTLR_EL1 |RW_ | 0x0000000000000000 | 64 B2.37 CPU Extended Control Register, EL1 on page B2-404 
Mapped to a 64-bit AArch32 register. 
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B2 AArch64 system registers 
B2.18 AArch64 Implementation defined registers 


Table B2-17 AArch64 implementation defined registers (continued) 





Name Type | Reset Width | Description 





CPUMERRSR ELI |RW |- 64 B2.38 CPU Memory Error Syndrome Register, ELI on page B2-406 
Mapped to a 64-bit AArch32 register. 





L2MERRSR_ ELI] |RW |- 64 B2.76 L2 Memory Error Syndrome Register, ELI on page B2-476 
Mapped to a 64-bit AArch32 register. 





CBAR EL1 RO |J- 64 B2.28 Configuration Base Address Register, EL1 on page B2-385 
The reset value depends on the PERIPHBASE signal. 





CDBGDRO_EL3 RO |UNK 32 Cache Debug Data Register 0, see C5. 1 About direct access to 
internal memory on page C5-582. 





CDBGDR1_EL3 RO |UNK 32 Cache Debug Data Register 1, see C5. 7 About direct access to 
internal memory on page C5-582. 





CDBGDR2_EL3 RO |UNK 32 Cache Debug Data Register 2, see C5. 1 About direct access to 
internal memory on page C5-582. 





CDBGDR3_EL3 RO |UNK 32 Cache Debug Data Register 3, see C5. 1 About direct access to 
internal memory on page C5-582. 





CDBGDCT_EL3 WO |UNK 32 Cache Debug Data Cache Tag Read Operation Register, see 
C5.1 About direct access to internal memory on page C5-582. 











CDBGICT_EL3 WO |UNK 32 Cache Debug Instruction Cache Tag Read Operation Register, see 
C5.1 About direct access to internal memory on page C5-582. 














CDBGDCD_EL3 WO |UNK 32 Cache Debug Cache Debug Data Cache Data Read Operation 
Register, see C5. 1 About direct access to internal memory 
on page C5-582. 





CDBGICD_EL3 WO |UNK 32 Cache Debug Instruction Cache Data Read Operation Register, see 
C5.1 About direct access to internal memory on page C5-582. 





CDBGTD_EL3 WO |UNK 32 Cache Debug TLB Data Read Operation Register, see C5./ About 
direct access to internal memory on page C5-582. 
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B2 AArch64 system registers 
B2.19 Auxiliary Control Register, EL1 


B2.19 Auxiliary Control Register, EL1 
ACTLR_EL1 


The processor does not implement the ACTLR_ELI register. This register is always RESO. 
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B2 AArch64 system registers 
B2.20 Auxiliary Control Register, EL2 


B2.20 Auxiliary Control Register, EL2 
The ACTLR_EL2 characteristics are: 


Purpose 
Controls write access to IMPLEMENTATION DEFINED registers in Non-secure EL1 modes, such as 
CPUACTLR, CPUECTLR, L2CTLR, L2ECTLR, and L2ZACTLR. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- |. [RW IRW RW 


























Configurations 
The ACTLR_EL2 is architecturally mapped to the AArch32 HACTLR register. See B/.55 Hyp 
Auxiliary Control Register on page B1-221. 

Attributes 
ACTLR_EL2 is a 32-bit register. 


31 7 ea [I 


6 5 4 
L2ACTLR_EL1 access cn 
L2ECTLR_EL1 access cn 
L2CTLR_EL1 access control 
CPUECTLR_EL1 access control 


CPUACTLR_EL1 access control 





Figure B2-1 ACTLR_EL2 bit assignments 


[31:7] 
Reserved, RESO. 
L2ACTLR_ELI access control, [6] 
L2ACTLR_ELI write access control. The possible values are: 


© The register is not write accessible from Non-secure EL1.This is the reset value. 
1 The register is write accessible from Non-secure EL1. 
Write access from Non-secure EL1 also requires ACTLR_EL3[6] to be set. 
L2ECTLR_EL1 access control, [5] 
L2ECTLR_EL1 write access control. The possible values are: 
© The register is not write accessible from Non-secure EL1.This is the reset value. 
1 The register is write accessible from Non-secure EL1. 
Write access from Non-secure EL1 also requires ACTLR_EL3[5] to be set. 
L2CTLR_ELI access control, [4] 
L2CTLR_ELI write access control. The possible values are: 
© The register is not write accessible from Non-secure EL1.This is the reset value. 
1 The register is write accessible from Non-secure EL1. 
Write access from Non-secure EL1 also requires ACTLR_EL3[4] to be set. 


[3:2] 
Reserved, RESO. 
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B2 AArch64 system registers 
B2.20 Auxiliary Control Register, EL2 


CPUECTLR_ELI access control, [1] 
CPUECTLR_EL]1 write access control. The possible values are: 


© The register is not write accessible from Non-secure EL1.This is the reset value. 


1 The register is write accessible from Non-secure EL1. 


Write access from Non-secure EL1 also requires ACTLR_EL3[1] to be set. 


CPUACTLR_EL1 access control, [0] 
CPUACTLR_ELI write access control. The possible values are: 


© The register is not write accessible from Non-secure EL1.This is the reset value. 


1 The register is write accessible from Non-secure EL1. 


Write access from Non-secure EL1 also requires ACTLR_EL3[0] to be set. 


To access the ACTLR_EL2: 


MRS <Xt>, ACTLR_EL2 ; Read ACTLR_EL2 into Xt 
MSR ACTLR_EL2, <Xt> ; Write Xt to ACTLR_EL2 


Register access is encoded as follows: 


Table B2-18 ACTLR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 | 0001 |0000 | 001 
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B2 AArch64 system registers 
B2.21 Auxiliary Control Register, EL3 


Auxiliary Control Register, EL3 


The ACTLR_EL3 characteristics are: 


Purpose 
Controls write access to IMPLEMENTATION DEFINED registers in EL2, such as CPUACTLR, 
CPUECTLR, L2CTLR, L2ECTLR, and LZACTLR. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
z z 2 7 RW RW 


























Configurations 
ACTLR_EL3 is mapped to AArch32 register ACTLR (S). See B/.32 Auxiliary Control Register 
on page B1-184. 

Attributes 
ACTLR_EL3 is a 32-bit register. 


31 7 ea [i 


6 5 4 
L2ACTLR_EL1 access cot! | 
L2ECTLR_EL1 access cot! | 
L2CTLR_EL1 access control 
CPUECTLR_EL1 access control 


CPUACTLR_EL1 access control 





Figure B2-2 ACTLR_EL3 bit assignments 


[31:7] 
Reserved, RESO. 
L2ACTLR_ELI access control, [6] 
L2ACTLR_ELI write access control. The possible values are: 


© The register is not write accessible from a lower exception level. This is the reset value. 
1 The register is write accessible from EL2. 

L2ECTLR_EL1 access control, [5] 
L2ECTLR_EL]1 write access control. The possible values are: 
© The register is not write accessible from a lower exception level. This is the reset value. 
1 The register is write accessible from EL2. 

L2CTLR_ELI access control, [4] 
L2CTLR_ELI write access control. The possible values are: 


© The register is not write accessible from a lower exception level. This is the reset value. 
1 The register is write accessible from EL2. 

[3:2] 
Reserved, RESO. 


CPUECTLR_ELI access control, [1] 
CPUECTLR_EL]1 write access control. The possible values are: 


© The register is not write accessible from a lower exception level. This is the reset value. 


1 The register is write accessible from EL2. 
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CPUACTLR_EL1 access control, [0] 


CPUACTLR_ELI write access control. The possible values are: 


B2 AArch64 system registers 


© The register is not write accessible from a lower exception level. This is the reset value. 


1 The register is write accessible from EL2. 


To access the ACTLR_EL3: 


MRS <Xt>, ACTLR_EL3 ; Read ACTLR_EL3 into Xt 
MSR ACTLR_EL3, <Xt> ; Write Xt to ACTLR_EL3 


Register access is encoded as follows: 


B2.21 Auxiliary Control Register, EL3 


Table B2-19 ACTLR_EL3 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 |110 | 0001 | 0000 | 001 
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B2 AArch64 system registers 
B2.22 Auxiliary Fault Status Register 0, EL1, EL2, and EL3 


B2.22 Auxiliary Fault Status Register 0, EL1, EL2, and EL3 
AFSRO_EL1, AFSRO EL2, and AFSRO_EL3 


The processor does not implement AFSRO_EL1, AFSRO EL2, and AFSRO_ EL3. These registers are 
always RESO. 
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B2 AArch64 system registers 
B2.23 Auxiliary Fault Status Register 1, EL1, EL2, and EL3 


B2.23 Auxiliary Fault Status Register 1,EL1, EL2, and EL3 
AFSR1_EL1, AFSR1_EL2, and AFSR1_EL3 


The processor does not implement AFSR1_EL1, AFSR1 EL2, and AFSR1_EL3. These registers are 
always RESO. 





ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B2-380 
reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.24 Auxiliary ID Register, EL1 


B2.24 Auxiliary ID Register, EL1 
AIDR_EL1 


The processor does not implement AIDR_ELI. This register is always RESO. 
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B2 AArch64 system registers 
B2.25 Auxiliary Memory Attribute Indirection Register, EL1 


B2.25 Auxiliary Memory Attribute Indirection Register, EL1 
AMAIR ELI 


The processor does not implement AMAIR_EL1. This register is always RESO. 
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B2 AArch64 system registers 
B2.26 Auxiliary Memory Attribute Indirection Register, EL2 


B2.26 Auxiliary Memory Attribute Indirection Register, EL2 
AMAIR_EL2 


The processor does not implement AMAIR_EL2. This register is always RESO. 
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B2 AArch64 system registers 
B2.27 Auxiliary Memory Attribute Indirection Register, EL3 


B2.27 Auxiliary Memory Attribute Indirection Register, EL3 
AMAIR_EL3 


The processor does not implement AMAIR_EL3. This register is always RESO. 
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B2 AArch64 system registers 
B2.28 Configuration Base Address Register, EL1 


B2.28 Configuration Base Address Register, EL1 
The CBAR_ELI characteristics are: 


Purpose 
Holds the physical base address of the memory-mapped GIC CPU interface registers. 
Usage constraints 
This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 
Configurations 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes 
CBAR_EL1 is a 64-bit register. 
40 39 18 17 0 





63 {¢ {¢ 
27 37 
RESO PERIPHBASE[39:18] RESO 


Figure B2-3 CBAR_EL1 bit assignments 


[63:40] 
Reserved, RESO. 
PERIPHBASE[39: 18], [39:18] 
If the processor is implemented with the GIC CPU interface, the input PERIPHBASE[39:18] 
determines the reset value. If the GIC CPU interface is not implemented, this field is RAZ. 
[17:0] 
Reserved, RESO. 
To access the CBAR_ELI: 


MRS <Xt>, S3_1_C15_C3_@ ; Read CBAR_EL1 into Xt 
Register access is encoded as follows: 


Table B2-20 CBAR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 {001 | 1111 |0011 | 000 























ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B2-385 
reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.29 Cache Size ID Register, EL1 


Cache Size ID Register, EL1 


The CCSIDR_EL1 characteristics are: 


Purpose 

Provides information about the architecture of the caches. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO |RO |RO RO 


























Configurations 
CCSIDR_ELI is architecturally mapped to AArch32 register CCSIDR. See B/.39 Cache Size 
ID Register on page B1-192. 

Attributes 
CCSIDR_ELI is a 32-bit register. 


31 30 29 28 27 13 12 3 2 0 


| NumSets Associativity 
wt — L_ WA LineSize — 
WB RA 


Figure B2-4 CCSIDR_EL1 bit assignments 





WT, [31] 
Indicates support for write-through: 
7) Cache level does not support write-through. 
WB, [30] 
Indicates support for write-back: 
(3 Cache level does not support write-back. 
1 Cache level supports write-back. 
RA, [29] 
Indicates support for Read-Allocation: 
(3 Cache level does not support Read-Allocation. 
1 Cache level supports Read-Allocation. 
WA, [28] 
Indicates support for Write-Allocation: 
(3 Cache level does not support Write-Allocation. 
1 Cache level supports Write-Allocation. 


NumSets, [27:13] 
Indicates the number of sets in cache - 1. Therefore, a value of 0 indicates 1 set in the cache. The 
number of sets does not have to be a power of 2. 


For more information about encoding, see Zable B2-2] CCSIDR_EL1 encodings 
on page B2-387. 
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Associativity, [12:3] 


B2 AArch64 system registers 
B2.29 Cache Size ID Register, EL1 


Indicates the associativity of cache - 1. Therefore, a value of 0 indicates an associativity of 1. 
The associativity does not have to be a power of 2. 


For more information about encoding, see Table B2-21 CCSIDR_ELI encodings 
on page B2-387. 


LineSize, [2:0] 


Indicates the (logy (number of words in cache line)) - 2: 


b010 16 words per line. 


The following table shows the individual bit field and complete register encodings for the CCSIDR_ELI1. 


Table B2-21 CCSIDR_EL1 encodings 








































































































CSSELR | Cache Size Complete register Register bit field encoding 
coe WT | WB | RA | WA | NumSets | Associativity | LineSize 
0x0 L1 Data cache 8KB 0x7003E01A 0 1 1 1 0x001F 0x003 0x2 
16KB 0x7007E01A 0x003F 0x003 0x2 
32KB 0x700FE01A 0x007F 0x003 0x2 
64KB 0x701FE01A Ox00FF 0x003 0x2 
0x1 L1 Instruction cache | 8KB 0x2007E00A 0 0 1 0 0x003F 0x001 0x2 
16KB 0x200FE00A 0x007F 0x001 0x2 
32KB 0x201FE00A Ox00FF 0x001 0x2 
64KB 0x203FE00A Q@x001F 0x001 0x2 
0x2 L2 cache 128KB |@0x700FE03A 0 1 1 1 OxOOFF 0x007 0x2 
256KB |0x701FE03A Q@xO1FF 0x007 0x2 
512KB |0x703FE03A 0x03FF 0x007 0x2 
1024KB | 0x707FE03A 0x07FF 0x007 0x2 
0x3-0xF | Reserved - - = - - = Es = = 








To access the CCSIDR_EL1: 


MRS <Xt>, CCSIDR_EL1 ; Read CCSIDR_EL1 into Xt 


Register access is encoded as follows: 


Table B2-22 CCSIDR_EL1 access encoding 





op0 | op1 


CRn 


CRm 


op2 





11 





001 





0000 





0000 


000 
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B2 AArch64 system registers 
B2.30 Cache Level ID Register, EL1 


Cache Level ID Register, EL1 


The CLIDR_EL1 characteristics are: 


Purpose 
Identifies: 
e The type of cache, or caches, implemented at each level. 
e The Level of Coherency and Level of Unification for the cache hierarchy. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
CLIDR_ ELI is architecturally mapped to AArch32 register CLIDR. See B/.40 Cache Level ID 
Register on page B1-194. 

Attributes 
CLIDR_EL1 is a 64-bit register. 


323029 2726 2423 2120 9 8 6 5 3 2 0 


Figure B2-5 CLIDR_EL1 bit assignments 


[63:33] 
Reserved, RESO. 
ICB, [32:30] 
Inner cache boundary. This field indicates the boundary between the inner and the outer domain. 


@beee = Not disclosed in this mechanism. 


LoUU, [29:27] 
Indicates the Level of Unification Uniprocessor for the cache hierarchy: 


@be@e1 L1 cache is the last level of cache that must be cleaned or invalidated when cleaning or 
invalidating to the point of unification for the processor. 


LoC, [26:24] 
Indicates the Level of Coherency for the cache hierarchy: 
@be@e1 L2 cache not implemented. A clean to the point of coherency operation requires the L1 
cache to be cleaned. 
@be@1@ L2 cache implemented. A clean to the point of coherency operation requires the L1 
and L2 caches to be cleaned. 


LoUIS, [23:21] 
Indicates the Level of Unification Inner Shareable for the cache hierarchy: 
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b010 L2 cache. 


B2 AArch64 system registers 


B2.30 Cache Level ID Register, EL1 


L2 cache is the last level of cache that must be cleaned or invalidated when cleaning or 
invalidating to the point of unification for the Inner Shareable shareability domain. 


If the processor is implemented without an L2 cache, or if BROADCASTINNER is 


set to 0, then LoUIS is 0b001, indicating the L1 cache. 


[20:9] 
Reserved, RESO. 
Ctype3, [8:6] 


Indicates the type of cache if the processor implements L3 cache: 


@beee L3 cache not implemented. 


If software reads the Cache Type fields from Ctypel upwards, after it has seen a value of @beee, 
no caches exist at further-out levels of the hierarchy. So, for example, if Ctype2 is the first 


Cache Type field with a value of @b@0@, the value of Ctype3 must be ignored. 


Ctype2, [5:3] 


Indicates the type of cache if the processor implements L2 cache: 


@beee L2 cache not implemented. 
@b10e@ Unified instruction and data caches at L2. 


Ctypel, [2:0] 
Indicates the type of cache implemented at L1: 


@b@11 Separate instruction and data caches at L1. 


To access the CLIDR_ELI: 


MRS <Xt>, CLIDR_EL1 ; Read CLIDR_EL1 into Xt 


Register access is encoded as follows: 


Table B2-23 CLIDR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 |001 | 0000 | 0000 | 001 
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B2 AArch64 system registers 
B2.31 Architectural Feature Access Control Register, EL1 


Architectural Feature Access Control Register, EL1 


The CPACR_ELI characteristics are: 


Purpose 
Controls access to trace functionality and access to registers associated with Advanced SIMD 
and floating-point execution. 


CPACR_EL1 is part of the Other system registers functional group. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW | RW RW 


























Configurations 
CPACR._EL! is architecturally mapped to AArch32 register CPACR. See B1.41 Architectural 
Feature Access Control Register on page B1-196. 

Attributes 
CPACR_ELI is a 32-bit register. 


31 292827 22 21 20 19 0 


RESO fl RESO a RESO 


L_TTA L_FPEN 


Figure B2-6 CPACR_EL1 bit assignments 


[31:29] 
Reserved, RESO. 
TTA, [28] 
Causes access to the Trace functionality to trap to EL1 when executed from ELO or EL1. 


This bit is RESO. 


[27:22] 
Reserved, RESO. 

FPEN, [21:20] 
Traps instructions that access registers associated with Advanced SIMD and floating-point 
execution to trap to EL1 when executed from ELO or EL1. The possible values are: 


@bxX@ Trap any instruction in ELO or EL1 that uses registers associated with Advanced SIMD 
and floating-point execution. The reset value is @b@@. 


@be1 Trap any instruction in ELO that uses registers associated with Advanced SIMD and 
floating-point execution. Instructions in EL1 are not trapped. 


@b11 No instructions are trapped. 
This field is Reso if Advanced SIMD and floating-point are not implemented. 


[19:0] 
Reserved, RESO. 


To access the CPACR_ELI: 


MRS <Xt>, CPACR_EL1 ; Read CPACR_EL1 into Xt 
MSR CPACR_EL1, <Xt> ; Write Xt to CPACR_EL1 


Register access is encoded as follows: 
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B2 AArch64 system registers 
B2.31 Architectural Feature Access Control Register, EL1 


Table B2-24 CPACR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 000 | 0001 | 0000 | 010 
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B2 AArch64 system registers 
B2.32 Architectural Feature Trap Register, EL2 


Architectural Feature Trap Register, EL2 


The CPTR_EL2 characteristics are: 


Purpose 
Controls trapping to EL2 for accesses to CPACR, Trace functionality and registers associated 
with Advanced SIMD and floating-point execution. Controls EL2 access to this functionality. 
Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- |. [RW IRW RW 


























Configurations 
CPTR_EL2 is architecturally mapped to AArch32 register HCPTR. See B/.60 Hyp 
Architectural Feature Trap Register on page B1-227. 


Attributes 
CPTR_EL2 is a 32-bit register. 
31 30 21 20 19 14 13 12 11 10 9 0 
LTCPAC LTTA reso! LTFP 


Figure B2-7 CPTR_EL2 bit assignments 


TCPAC, [31] 
Traps direct access to CPACR from Non-secure EL1 to EL2. The possible values are: 
@ Access to CPACR is not trapped. This is the reset value. 
1 Access to CPACR is trapped. 


[30:21] 

Reserved, RESO. 
TTA, [20] 

Trap Trace Access. 


Not implemented. REso. 


[19:14] 
Reserved, RESO. 
[13:12] 
Reserved, RESI. 
[11] 
Reserved, RESO. 
TFP, [10] 
Traps instructions that access registers associated with Advanced SIMD and floating-point 
execution from a lower exception level to EL2, unless trapped to EL1. The possible values are: 


@ Instructions are not trapped. This is the reset value if Advanced SIMD and floating-point are 
implemented. 


1 Instructions are trapped. This is always the value if Advanced SIMD and floating-point are 
not implemented. 


[9:0] 
Reserved, RESI. 
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B2 AArch64 system registers 
B2.32 Architectural Feature Trap Register, EL2 


To access the CPTR_EL2: 


MRS <Xt>, CPTR_EL2 ; Read CPTR_EL2 into Xt 
MSR CPTR_EL2, <Xt> ; Write Xt to CPTR_EL2 
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B2.33 Architectural Feature Trap Register, EL3 


B2.33 Architectural Feature Trap Register, EL3 
The CPTR_EL3 characteristics are: 


Purpose 
Controls trapping to EL3 for accesses to CPACR, Trace functionality and registers associated 
with Advanced SIMD and floating-point execution. Controls EL3 access to this functionality. 


CPTR_EL3 is part of the Security registers functional group. 


Usage constraints 
This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
z z - - RW RW 
Configurations 
There are no configuration notes. 
Attributes 
CPTR_EL3 is a 32-bit register. 
31 30 21 20 19 14 13 12 11 10 9 0 
L_TCPAC L_TTA L—TFP 


Figure B2-8 CPTR_EL3 bit assignments 


TCPAC, [31] 
This causes a direct access to the CPACR_EL1 from EL1 or the CPTR_EL2 from EL2 to trap to 
EL3 unless it is trapped at EL2. The possible values are: 


© Does not cause access to the CPACR_EL1 or CPTR_EL2 to be trapped. 
1 Causes access to the CPACR_EL1 or CPTR_EL2? to be trapped. 


[30:21] 

Reserved, RESO. 
TTA, [20] 

Trap Trace Access. 


Not implemented. REso. 


[19:11] 
Reserved, RESO. 

TFP, [10] 
This causes instructions that access the registers associated with Advanced SIMD or floating- 
point execution to trap to EL3 when executed from any exception level, unless trapped to EL1 
or EL2. The possible values are: 


Ə Does not cause any instruction to be trapped.This is the reset value if the Advanced SIMD 
and floating-point support is implemented. 


1 Causes any instructions that use the registers associated with Advanced SIMD or floating- 
point execution to be trapped. This is always the value if the Advanced SIMD and floating- 
point support is not implemented. 
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B2 AArch64 system registers 
B2.33 Architectural Feature Trap Register, EL3 


[9:0] 
Reserved, RESO. 


To access the CPTR_EL3: 


MRS <Xt>, CPTR_EL3 ; Read CPTR_EL3 into Xt 
MSR CPTR_EL3, <Xt> ; Write Xt to CPTR_EL3 
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B2 AArch64 system registers 
B2.34 Cache Size Selection Register, EL1 


B2.34 Cache Size Selection Register, EL1 
CSSELR_EL1 
The CSSELR_ELI characteristics are: 


Purpose 
Selects the current B/.39 Cache Size ID Register on page B1-192, by specifying: 
¢ The required cache level. 
e The cache type, either instruction or data cache. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW | RW RW 


























Configurations 
CSSELR_EL1 is architecturally mapped to AArch32 register CSSELR(NS). See B1.45 Cache 
Size Selection Register on page B1-207. 

Attributes 
CSSELR_ ELI is a 32-bit register. 


31 4 3 1 0 


UNK/SBZP tevet | 


inp! 


Figure B2-9 CSSELR_EL1 bit assignments 


[31:4] 
Reserved, RESO. 
Level, [3:1] 
Cache level of required cache: 


Q@beee Ll. 
Q@be0e1 L2. 
@bQ10-@b111 Reserved. 


The combination of Level=@be01 and InD=1 is reserved. 


InD, [0] 
Instruction not Data bit: 


@ Data or unified cache. 

1 Instruction cache. 

The combination of Level=@be01 and InD=1 is reserved. 
To access the CSSELR_EL1: 


MRS <Xt>, CSSELR_EL1 ; Read CSSELR_EL1 into Xt 
MSR CSSELR_EL1, <Xt> ; Write Xt to CSSELR_EL1 


Register access is encoded as follows: 
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B2 AArch64 system registers 
B2.34 Cache Size Selection Register, EL1 


Table B2-25 CSSELR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 010 | 0000 | 0001 | 000 
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B2 AArch64 system registers 
B2.35 Cache Type Register, ELO 


B2.35 Cache Type Register, ELO 
The CTR_ELO characteristics are: 


Purpose 

Provides information about the architecture of the caches. 
Usage constraints 

This register is accessible as follows: 








ELO |EL1 |EL1/EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
Config| RO |RO |RO |RO RO 


























This register is accessible at ELO when SCTLR_EL1.UCT is set to 1. 


Configurations 
CTR_ELO is architecturally mapped to AArch32 register CTR. See B/.46 Cache Type Register 
on page B1-209. 


Attributes 
CTR_ELO is a 32-bit register. 
3130 2827 24 23 20 19 16 15 14 13 4 3 0 
So e e 
Lres1 
Figure B2-10 CTR_ELO bit assignments 
[31] 


Reserved, RES1. 

[30:28] 
Reserved, RESO. 

CWG, [27:24] 
Cache Write-Back granule. Log, of the number of words of the maximum size of memory that 
can be overwritten as a result of the eviction of a cache entry that has had a memory location in 
it modified: 


0x4 Cache Write-Back granule size is 16 words. 
ERG, [23:20] 
Exclusives Reservation Granule. Log, of the number of words of the maximum size of the 


reservation granule that has been implemented for the Load-Exclusive and Store-Exclusive 
instructions: 


@x4 Exclusive reservation granule size is 16 words. 
DminLine, [19:16] 


Log, of the number of words in the smallest cache line of all the data and unified caches that the 
processor controls: 


0x4 Smallest data cache line size is 16 words. 
L1lp, [15:14] 


L1 Instruction cache policy. Indicates the indexing and tagging policy for the L1 Instruction 
cache: 


@b10 Virtually Indexed Physically Tagged (VIPT). 


[13:4] 
Reserved, RESO. 
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B2 AArch64 system registers 
B2.35 Cache Type Register, ELO 


IminLine, [3:0] 


Log, of the number of words in the smallest cache line of all the instruction caches that the 


processor controls. 


0x4 Smallest instruction cache line size is 16 words. 
To access the CTR_ELO: 
MRS <Xt>, CTR_EL@ ; Read CTR_EL@ into Xt 


Register access is encoded as follows: 


Table B2-26 CTR_ELO access encoding 





























op0 | op1 | CRn | CRm | op2 
11 |011 |0000 |0000 | 001 
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B2 AArch64 system registers 
B2.36 CPU Auxiliary Control Register, EL1 


B2.36 CPU Auxiliary Control Register, EL1 
The CPUACTLR_ELI characteristics are: 


Purpose 
Provides IMPLEMENTATION DEFINED configuration and control options for the processor. There is 
one 64-bit CPU Auxiliary Control Register for each core in the processor. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW [RW RW 


























The CPU Auxiliary Control Register can be written only when the system is idle. ARM 
recommends that you write to this register after a powerup reset, before the MMU is enabled, 
and before any master interface or ACP traffic begins. 


Setting many of these bits can cause significantly lower performance on your code. Therefore, it 
is suggested that you do not modify this register unless directed by ARM. 


Configurations 
CPUACTLR_ ELI is: 
e Common to the Secure and Non-secure states. 
e Mapped to the AArch32 CPUACTLR register. B/.42 CPU Auxiliary Control Register 
on page B1-198. 


Attributes 
CPUACTLR_ ELI is a 64-bit register. 


45 44 43 31 30 29 28 27 26 25 24 23 22 21 201918171615 13121110 9 7 65 


ENDCCASCI— CDIDIS— | Loe | Lorn 
DIDIS = | Lovens L1DEIEN 
RADIS DSTDIS RESO 
L1RADIS NPFSTRM 





DTAH 
STBPFRS 


RESO 
STBPFDIS 


Figure B2-11 CPUACTLR_EL1 bit assignments 


[63:45] 
Reserved, RESO. 
ENDCCASCT, [44] 
Enable data cache clean as data cache clean/invalidate. The possible values are: 


(3 Normal behavior, data cache clean operations are unaffected. This is the reset value. 


1 Executes data cache clean operations as data cache clean and invalidate. The following 
operations are affected: 


¢« In AArch32, DCCSW is executed as DCCISW, DCCMVAU and DCCMVAC are 





executed as DCCIMVAC. 
¢ In AArch64, DC CSW is executed as DC CISW, DC CVAU and DC CVAC are 
executed as DC CIVAC. 
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B2 AArch64 system registers 
B2.36 CPU Auxiliary Control Register, EL1 
[43:31] 
Reserved, RESO. 
CDIDIS, [30] 
Disable Cryptographic dual issue. The possible values are: 


) Enable dual issue of floating-point, Advanced SIMD and Cryptographic instructions. 
This is the reset value. 

1 Disable dual issue of floating-point, Advanced SIMD and Cryptographic instructions. 
DIDIS, [29] 

Disable Dual Issue. The possible values are: 

(3 Enable Dual Issue of instructions. This is the reset value. 

1 Disable Dual Issue of all instructions. 
RADIS, [28:27] 

Write streaming no-allocate threshold. The possible values are: 

@bee 16th consecutive streaming cache line does not allocate in the L1 or L2 cache. 


@b@1 128th consecutive streaming cache line does not allocate in the L1 or L2 cache. This is 
the reset value. 


@b1@ 512th consecutive streaming cache line does not allocate in the L1 or L2 cache. 

@b11 Disables streaming. All write-allocate lines allocate in the L1 or L2 cache. 
LIRADIS, [26:25] 

Write streaming no-L1-allocate threshold. The possible values are: 


@bee 4th consecutive streaming cache line does not allocate in the L1 cache. This is the 
reset value. 

@b@1 64th consecutive streaming cache line does not allocate in the L1 cache. 

@b1@ 128th consecutive streaming cache line does not allocate in the L1 cache. 


@b11 Disables streaming. All write-allocate lines allocate in the L1 cache. 


DTAH, [24] 
Disable transient and no-read-allocate hints for loads. The possible values are: 
(3 Normal operation. 
1 Transient and no-read-allocate hints in the MAIR are ignored and treated the same as 


non-transient, read-allocate types for loads. The LDNP instruction in AArch64 behaves 
the same as the equivalent LDP instruction. This is the reset value. 


STBPFRS, [23] 
Disable ReadUnique request for prefetch streams initiated by STB accesses: 


(3 ReadUnique used for prefetch streams initiated from STB accesses. This is the reset 
value. 
1 ReadShared used for prefetch streams initiated from STB accesses. 


STBPFDIS, [22] 
Disable prefetch streams initiated from STB accesses: 
(2) Enable Prefetch streams initiated from STB accesses. This is the reset value. 
1 Disable Prefetch streams initiated from STB accesses. 
[21] 
Reserved, RESO. 


NPFSTRM, [20:19] 
Number of independent data prefetch streams. The possible values are: 


@bee 1 stream. 
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B2 AArch64 system registers 
B2.36 CPU Auxiliary Control Register, EL1 
@b@1 2 streams. This is the reset value. 
@b18 3 streams. 
Q@b11 4streams. 
DSTDIS, [18] 
Enable device split throttle. The possible values are: 
@ Device split throttle disabled. 
1 Device split throttle enabled. This is the reset value. 


STRIDE, [17] 
Configure the sequence length that triggers data prefetch streams. The possible values are: 
(3 2 linefills to consecutive cache lines triggers prefetch. This is the reset value. 


1 3 linefills to consecutive cache lines triggers prefetch. 


In both configurations, Three linefills with a fixed stride pattern are required to trigger prefetch, 
if the stride spans more than one cache line. 
[16] 
Reserved, RESO. 
LIPCTL, [15:13] 
L1 Data prefetch control. The value of the this field determines the maximum number of 
outstanding data prefetches allowed in the L1 memory system, excluding those generated by 
software load or PLD instructions. The possible values are: 
@beee Prefetch disabled. 
@bee1 1 outstanding prefetch allowed. 
@be1@ 2 outstanding prefetches allowed. 
@be11 3 outstanding prefetches allowed. 
@b10e@ 4 outstanding prefetches allowed. 
@b101 5 outstanding prefetches allowed. This is the reset value. 
@b11@ 6 outstanding prefetches allowed. 
@b111 8 outstanding prefetches allowed. 
[12:11] 
Reserved, RESO. 
DODMBS, [10] 
Disable optimized Data Memory Barrier behavior. The possible values are: 
@ Enable optimized Data Memory Barrier behavior. This is the reset value. 
1 Disable optimized Data Memory Barrier behavior. 
[9:7] 
Reserved, RESO. 
L1DEIEN, [6] 
L1 D-cache data RAM error injection enable. The possible values are: 
(3 Normal behavior, errors are not injected. This is the reset value. 


1 Double-bit errors are injected on all writes to the L1 D-cache data RAMs for the first 
word of each 32-byte region. 


[5:0] 
Reserved, RESO. 


To access the CPUACTLR_ELI1: 


MRS <Xt>, S3_1_C15_C2_0 ; Read EL1 CPU Auxiliary Control Register 
MSR S3_1_C15_C2_@, <Xt> ; Write EL1 CPU Auxiliary Control Register 
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Register access is encoded as follows: 


B2 AArch64 system registers 
B2.36 CPU Auxiliary Control Register, EL1 


Table B2-27 CPUACTLR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 001 | 1111 |0010 | 000 
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B2.37 CPU Extended Control Register, EL1 
The CPUECTLR_ ELI characteristics are: 


Purpose 


Provides additional IMPLEMENTATION DEFINED configuration and control options for the processor. 


Usage constraints 


Configurations 


This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW | RW | RW RW 


























The CPUECTLR_ELI can be written dynamically. 


The CPUECTLR_ELI is write accessible in EL1 if ACTLR_EL3.CPUECTLR is 1 and 
ACTLR_EL2.CPUECTLR is 1, or ACTLR_EL3.CPUECTLR is 1 and SCR.NS is 0. 


The CPUECTLR_ELI is write accessible in EL2 if ACTLR_EL3.CPUECTLR is 1. 





The CPUECTLR_EL] is mapped to the AArch32 CPUECTLR register. See B/.43 CPU 
Extended Control Register on page B1-202. 


Attributes 


63 


CPUECTLR_EL] is a 64-bit register. 


RESO 


[63:7] 


SMPEN— 
FPRETCTL 
CPURETCTL 
Figure B2-12 CPUECTLR_EL1 bit assignments 


Reserved, RESO. 


SMPEN, [6] 


[5:3] 


Enable hardware management of data coherency with other cores in the cluster. The possible 
values are: 

(3 Disables data coherency with other cores in the cluster. This is the reset value. 

1 Enables data coherency with other cores in the cluster. 


Set the SMPEN bit before enabling the caches, even if there is only one core in the system. 


Advanced SIMD and floating-point retention control. The possible values are: 


@beee Disable the retention circuit. This is the reset value. 

@bee1 2 Architectural Timer ticks are required before retention entry. 
@be1e@ 8 Architectural Timer ticks are required before retention entry. 
@b@11 32 Architectural Timer ticks are required before retention entry. 
@b10e@ 64 Architectural Timer ticks are required before retention entry. 
@b101 128 Architectural Timer ticks are required before retention entry. 
@b11@ 256 Architectural Timer ticks are required before retention entry. 
@b111 512 Architectural Timer ticks are required before retention entry. 
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B2 AArch64 system registers 
B2.37 CPU Extended Control Register, EL1 


This field is present only if the Advanced SIMD and floating-point support is implemented. 
Otherwise, it is RESO. 


CPU retention control. The possible values are: 


e@beee 
@be01 
0be10 
@be11 
0b100 
@b101 
0b110 
@b111 


Disable the retention circuit. This is the reset value. 

2 Architectural Timer ticks are required before retention entry. 

8 Architectural Timer ticks are required before retention entry. 
32 Architectural Timer ticks are required before retention entry. 
64 Architectural Timer ticks are required before retention entry. 
128 Architectural Timer ticks are required before retention entry. 
256 Architectural Timer ticks are required before retention entry. 


512 Architectural Timer ticks are required before retention entry. 


To access the CPUECTLR_ ELI: 


MRS <Xt>, S3_1_C15_C2_1; Read EL1 CPU Extended Control Register 
MSR S3_1_C15_C2_1, <Xt>; Write EL1 CPU Extended Control Register 


Register access is encoded as follows: 


Table B2-28 CPUECTLR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 001 | 1111 |0010 | 001 
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B2.38 CPU Memory Error Syndrome Register, EL1 
The CPUMERRSR _ ELI characteristics are: 


Purpose 
Holds ECC errors on the: 
e LI data RAMs. 
e LI tag RAMs. 
¢ LI dirty RAMs. 
e TLB RAMs. 


B2 AArch64 system registers 
B2.38 CPU Memory Error Syndrome Register, EL1 


This register is used for recording ECC errors on all processor RAMs. 


Usage constraints 
This register is accessible as follows: 























ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW | RW RW 











Configurations 


The CPUMERRSR _ ELI is mapped to the AArch32 CPUMERRSR register. See B/.44 CPU 
Memory Error Syndrome Register on page B1-204. 


There is one copy of this register that is used in both Secure and Non-secure states. 


A write of any value to the register updates the register to 0xeeeeee0e00000000. 







Attributes 
CPUMERRSR ELl! is aa 64-bit register. 
63 62 48 47 40 39 32 31 30 
Other error 
| RESO 
count 
L Fatal Valid ~ 


24 23 21 20 18 17 12 11 


CPUID/Way 


0 


Repeat error RAMID | RESO RESO RAM address 
count 


Figure B2-13 CPUMERRSR_EL1 bit assignments 


Fatal, [63] 


Fatal bit. This bit is set to 1 on the first memory error that caused a data abort. It is a sticky bit 
so that after it is set, it remains set until the register is written. 


The reset value is 0. 


[62:48] 
Reserved, RESO. 
Other error count, [47:40] 


This field is set to 0 on the first memory error and is incremented on any memory error that does 
not match the RAMID and Bank/Way information in this register while the sticky Valid bit is 


set. 
The reset value is 0. 


Repeat error count, [39:32] 


This field is set to 0 on the first memory error and is incremented on any memory error that 
exactly matches the RAMID and Bank/Way information in this register while the sticky Valid 


bit is set. 


The reset value is 0. 
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Valid, [31] 
Valid bit. This bit is set to 1 on the first memory error. It is a sticky bit so that after it is set, it 
remains set until the register is written. 


RAMID, [30:24] 


[23:21] 


B2 AArch64 system registers 


B2.38 CPU Memory Error Syndrome Register, EL1 


The reset value is 0. 


RAM Identifier. Indicates the RAM in which the first memory error. The possible values are: 


exee@ L1 Instruction tag RAM. 
@xe1 L1 Instruction data RAM. 
exes L1 Data tag RAM. 

exe9 L1 Data data RAM. 

ƏxðA LI Data dirty RAM. 

0x18 TLB RAM. 


Reserved, RESO. 


CPUID/Way, [20:18] 
Indicates the RAM where the first memory error occurred. 


L1 I-tag RAM 
@x® Way 0 
@x1 Way 1 
@x2-0x7 Unused 
L1 I-data RAM 
@x® Bank 0 
@x1 Bank 1 
@x2-Ox7 Unused 
TLB RAM 
@x® Way 0 
@x1 Way 1 
@x2-0x7 Unused 
L1 D-dirty RAM 
exe Dirty RAM 
@x1-0x7 Unused 
L1 D-tag RAM 
@x® Way 0 
@x1 Way 1 
0x2 Way 2 
0x3 Way 3 
0x4-0x7 Unused 
L1 D-data RAM 
@x® Bank0O 
@x1 Bank1 
@x2 Bank2 
0x3 Bank3 
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B2 AArch64 system registers 
B2.38 CPU Memory Error Syndrome Register, EL1 


0x7 Bank7 


[17:12] 
Reserved, RESO. 
RAM address, [11:0] 
Indicates the index address of the first memory error. 


e A fatal error results in the RAMID, Way, and RAM address recording the fatal error, even if the 


sticky bit is set. 


e Only LI Data data and L1 Data dirty RAMs can signal fatal errors, because all other RAM instances 


are protected only by parity. 


¢ Iftwo or more memory errors in the same RAM occur in the same cycle, only one error is reported. 
¢ Iftwo or more first memory error events from different RAMs occur in the same cycle, one of the 


errors is selected arbitrarily. 


e Iftwo or more memory error events from different RAMs, that do not match the RAMID, Way, and 
index information in this register while the sticky Valid bit is set, occur in the same cycle, then the 


Other error count field is incremented only by one. 
To access the CPUMERRSR ELI: 


MRS <Xt>, S3_1_c15_c2_2 ; Read CPUMERRSR into Xt 
MSR S31 c15_c2_2, <Xt> ; Write Xt to CPUMERRSR 


Register access is encoded as follows: 


Table B2-29 CPUMERRSR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 {001 | 1111 |0010 | 010 
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B2.39 Domain Access Control Register, EL2 
The DACR32_EL2 characteristics are: 


Purpose 
Allows access to the AArch32 DACR register from AArch64 state only. Its value has no effect 
on execution in AArch64 state. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- |. [RW IRW RW 


























Configurations 
DACR32_EL2 is architecturally mapped to AArch32 register DACR (NS). See B/.47 Domain 
Access Control Register on page B1-211. 

Attributes 
DACR32_EL2 is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16:15 14 13 1211 109 8 76543210 


mrs [pa [prap [pn oro] vo | oe | ov | pe | os | a | os | 2 | or | oo 


Figure B2-14 DACR32_EL2 bit assignments 





D<n>, bits [2n+1:2n], for n = 0 to 15, [31:0] 
Domain n access permission, where n = 0 to 15. Permitted values are: 


@bee No access. Any access to the domain generates a Domain fault. 
b01 Client. Accesses are checked against the permission bits in the translation tables. 


@b11 Manager. Accesses are not checked against the permission bits in the translation tables. 


The value @b1@ is reserved. 
To access the DACR32_EL2: 


MRS <Xt>, DACR32_EL2 ; Read DACR32_EL2 into Xt 
MSR DACR32_EL2, <Xt> ; Write Xt to DACR32_EL2 


Register access is encoded as follows: 


Table B2-30 DACR32_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 | 0011 | 0000 | 000 
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Data Cache Zero ID Register, ELO 


The DCZID_ELO characteristics are: 


Purpose 
Indicates the block size written with byte values of zero by the DC ZVA (Cache Zero by 
Address), system instruction. 

Usage constraints 
This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
RO |RO |RO |RO |RO RO 
Configurations 
There are no configuration notes. 
Attributes 
DCZID_ELO is a 32-bit register. 
31 5 4 3 0 
| fea 
DZP— 
Figure B2-15 DCZID_ELO bit assignments 
[32:5] 


Reserved, RESO. 
DZP, [4] 
Prohibit the DC ZVA instruction: 


(3 DC ZVA instruction permitted. 
1 DC ZVA instruction is prohibited. 


BlockSize, [3:0] 
Log2 of the block size in words: 


@be10@ The block size is 16 words. 


To access the DCZID_ELO: 


MRS <Xt>, DCZID_EL@ ; Read DCZID_EL@ into Xt 
Register access is encoded as follows: 


Table B2-31 DCZID_ELO access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 011 | 0000 | 0000 | 111 
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B2.41 Exception Syndrome Register, EL1 
The ESR_EL1 characteristics are: 


Purpose 


B2 AArch64 system registers 
B2.41 Exception Syndrome Register, EL1 


Holds syndrome information for an exception taken to EL1. 


Usage constraints 
This register is accessible as follows: 


Configurations 














ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW | RW RW 




















ESR_ELI1 is architecturally mapped to AArch32 register DFSR (NS). See B/.49 Data Fault 


Status Register on page B1-213. 


0 


Figure B2-16 ESR_EL1 bit assignments 


Exception Class. Indicates the reason for the exception that this register holds information 


Instruction Length for synchronous exceptions. The possible values are: 


Attributes 
ESR _ EL] is a 32-bit register. 
31 26 25 24 23 
ke ISS Valid 
IL 
EC, [31:26] 
about. 
IL, [25] 
@ 16-bit. 
1 32-bit. 


This field is 1 for the SError interrupt, instruction aborts, misaligned PC, Stack pointer 
misalignment, data aborts for which the ISV bit is 0, exceptions caused by an illegal instruction 
set state, and exceptions using the 0x00 Exception Class. 


ISS Valid, [24] 


Syndrome valid. The possible values are: 


(2) ISS not valid, ISS is RESO. 
1 ISS valid. 
ISS, [23:0] 


Syndrome information. 


When the EC field is @x2F, indicating an SError interrupt has occurred, the ISS field contents are 


IMPLEMENTATION DEFINED. 


Table B2-32 ISS field contents for the Cortex-A35 processor 





























ISS[23:22] | ISS[1:0] | Description 
@bee ebee DECERR on external access 
@bee @be1 Double-bit error detected on dirty line in L2 cache 
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Table B2-32 ISS field contents for the Cortex-A35 processor (continued) 























ISS[23:22] | ISS[1:0] | Description 

ebee @b10 SLVERR on external access 

Qbe1 ebee nSEI, or nVSEI in a guest OS, asserted 
@be1 @be1 nREI asserted 








To access the ESR_EL1: 


MRS <Xt>, ESR_EL1 ; Read EL1 Exception Syndrome Register 
MSR ESR_EL1, <Xt> ; Write EL1 Exception Syndrome Register 


Register access is encoded as follows: 


Table B2-33 ESR_EL1 access encoding 
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op0 | op1 | CRn | CRm | op2 
11 | 000 | 0101 | 0010 | 000 
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Exception Syndrome Register, EL2 


The ESR_EL2 characteristics are: 


Purpose 

Holds syndrome information for an exception taken to EL2. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- J- [RW IRW RW 


























Configurations 
ESR_EL2 is architecturally mapped to AArch32 register HSR. See B/.68 Hyp Syndrome 
Register on page B1-248. 


Attributes 

ESR _EL2 is a 32-bit register. 

31 26 25 24 0 
L IL 
Figure B2-17 ESR_EL2 bit assignments 

EC, [31:26] 

Exception Class. Indicates the reason for the exception that this register holds information 

about. 
IL, [25] 

Instruction Length for synchronous exceptions. The possible values are: 

@ 16-bit. 

1 32-bit. 
ISS, [24:0] 


Syndrome information. 


When the EC field is @x2F, indicating an SError interrupt has occurred, the ISS field contents are 
IMPLEMENTATION DEFINED. 


Table B2-34 ISS field contents for the Cortex-A35 processor 

















ISS[23:22] | ISS[1:0] | Description 

@bee e@bee DECERR on external access 

@bee @be1 Double-bit error detected on dirty line in L2 cache 
e@bee 0b10 SLVERR on external access 

@be1 @bee nSEI , or nVSEI in a guest OS, asserted 

@be1 @be1 nREI asserted 

















To access the ESR_EL2: 


MRS <Xt>, ESR_EL2 ; Read EL1 Exception Syndrome Register 
MSR ESR_EL2, <Xt> ; Write EL1 Exception Syndrome Register 
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Register access is encoded as follows: 


B2 AArch64 system registers 
B2.42 Exception Syndrome Register, EL2 


Table B2-35 ESR_EL2 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 100 | 0101 | 0010 | 000 
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B2.43 Exception Syndrome Register, EL3 
The ESR_EL3 characteristics are: 


Purpose 

Holds syndrome information for an exception taken to EL3. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
= P z z RW RW 


























Configurations 
ESR_EL3 is mapped to AArch32 register DFSR(S). See B/.49 Data Fault Status Register 
on page B1-213. 

Attributes 
ESR_EL3 is a 32-bit register. 


31 26 25 24 23 0 


L ISS Valid 
IL 


Figure B2-18 ESR_EL3 bit assignments 


EC, [31:26] 
Exception Class. Indicates the reason for the exception that this register holds information 
about. 
IL, [25] 
Instruction Length for synchronous exceptions. The possible values are: 
@ 16-bit. 
1 32-bit. 


This field is 1 for the SError interrupt, instruction aborts, misaligned PC, Stack pointer 
misalignment, data aborts for which the ISV bit is 0, exceptions caused by an illegal instruction 
set state, and exceptions using the 0x0 Exception Class. 


ISS Valid, [24] 
Syndrome valid. The possible values are: 


(2) ISS not valid, ISS is RESO. 
1 ISS valid. 
ISS, [23:0] 


Syndrome information. 


When the EC field is @x2F, indicating an SError interrupt has occurred, the ISS field contents are 
IMPLEMENTATION DEFINED. 


Table B2-36 ISS field contents for the Cortex-A35 processor 





ISS[23:22] | ISS[1:0] | Description 


























@bee ebee DECERR on external access 
@bee @be1 Double-bit error detected on dirty line in L2 cache 
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Table B2-36 ISS field contents for the Cortex-A35 processor (continued) 























ISS[23:22] | ISS[1:0] | Description 

ebee @b10 SLVERR on external access 

Qbe1 ebee nSEI, or nVSEI in a guest OS, asserted 
@be1 @be1 nREI asserted 








To access the ESR_EL3: 


MRS <Xt>, ESR_EL3 ; Read EL3 Exception Syndrome Register 
MSR ESR_EL3, <Xt> ; Write EL3 Exception Syndrome Register 


Register access is encoded as follows: 


Table B2-37 ESR_EL3 access encoding 





op0 | op1 


CRn 


CRm 


op2 





11 | 110 








0101 





0010 





000 
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B2.44 Fault Address Register, EL1 
The FAR_EL1 characteristics are: 


Purpose 
Holds the faulting Virtual Address for all synchronous instruction or data aborts, or exceptions 
from a misaligned PC or a Watchpoint debug event, taken to EL1. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- {RW [RW [RW [RW RW 


























Configurations 


FAR_EL1[31:0] is architecturally mapped to AArch32 register DFAR (NS). See B/.48 Data 
Fault Address Register on page B1-212. 


FAR_EL1[63:32] is architecturally mapped to AArch32 register IFAR (NS). See 
B1.86 Instruction Fault Address Register on page B1-282. 


Attributes 
FAR_ELI is a 64-bit register. 


63 0 


Figure B2-19 FAR_EL1 bit assignments 
VA, [63:0] 


The faulting Virtual Address for all synchronous instruction or data aborts, or an exception from 
a misaligned PC, taken in ELI. 


Ifa memory fault that sets the FAR is generated from one of the data cache instructions, this 
field holds the address specified in the register argument of the instruction. 


To access the FAR_ELI: 


MRS <Xt>, FAR_EL1 ; Read EL1 Fault Address Register 
MSR FAR_EL1, <Xt> ; Write EL1 Fault Address Register 


Register access is encoded as follows: 


Table B2-38 FAR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0110 | 0000 | 000 
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B2.45 Fault Address Register, EL2 
The FAR_EL2 characteristics are: 


Purpose 
Holds the faulting Virtual Address for all synchronous instruction or data aborts, or exceptions 
from a misaligned PC or a Watchpoint debug event, taken to EL2. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- |. [RW IRW RW 


























Configurations 
FAR_EL2[31:0] is architecturally mapped to AArch32 registers: 
¢ HDFAR. See B1.64 Hyp Data Fault Address Register on page B1-241. 
¢« DFAR (S). See B/.48 Data Fault Address Register on page B1-212. 


FAR_EL2[63:32] is architecturally mapped to AArch32 registers: 
e HIFAR. See B/.65 Hyp Instruction Fault Address Register on page B1-242. 
e IFAR (S). See B1.86 Instruction Fault Address Register on page B1-282. 


Attributes 
FAR_EL2 is a 64-bit register. 


63 0 


Figure B2-20 FAR_EL2 bit assignments 


VA, [63:0] 
The faulting Virtual Address for all synchronous instruction or data aborts, or an exception from 
a misaligned PC, taken in EL2. 


Ifa memory fault that sets the FAR is generated from one of the data cache instructions, this 
field holds the address specified in the register argument of the instruction. 


To access the FAR_EL2: 


MRS <Xt>, FAR_EL2 ; Read EL2 Fault Address Register 
MSR FAR_EL2, <Xt> ; Write EL2 Fault Address Register 


Register access is encoded as follows: 


Table B2-39 FAR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 |0110 | 0000 | 000 
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B2.46 Fault Address Register, EL3 
The FAR_EL3 characteristics are: 


Purpose 
Holds the faulting Virtual Address for all synchronous instruction or data aborts, or exceptions 
from a misaligned PC, taken to EL3. 

Usage constraints 
This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - - RW RW 
Configurations 
There is no additional configuration data for FAR_EL3. 
Attributes 
FAR_EL3 is a 64-bit register. 
63 0 


Figure B2-21 FAR_EL3 bit assignments 


VA, [63:0] 
The faulting Virtual Address for all synchronous instruction or data aborts, or an exception from 
a misaligned PC, taken in EL3. 


Ifa memory fault that sets the FAR is generated from one of the data cache instructions, this 
field holds the address specified in the register argument of the instruction. 


To access the FAR_EL3: 


MRS <Xt>, FAR_EL3 ; Read EL3 Fault Address Register 
MSR FAR_EL3, <Xt> ; Write EL3 Fault Address Register 


Register access is encoded as follows: 


Table B2-40 FAR_EL3 access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 110 |0110 | 0000 | 000 
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B2.47 Hyp Auxiliary Configuration Register, EL2 
HACR_EL2 


The processor does not implement HACR_EL2. This register is always RESO. 
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B2.48 Hypervisor Configuration Register, EL2 
The HCR_EL2 characteristics are: 


Purpose 
Provides configuration control for virtualization, including whether various Non-secure 
operations are trapped to EL2. 


HCR_EL2 is part of the Hypervisor and virtualization registers functional group. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- f- |. [RW IRW RW 


























Configurations 
HCR_EL2[31:0] is architecturally mapped to AArch32 register HCR. See B/.6/ Hyp 
Configuration Register on page B1-230. 


HCR_EL2[63:32] is architecturally mapped to AArch32 register HCR2. See B/.62 Hyp 
Configuration Register 2 on page B1-236. 


Attributes 
HCR_EL2 is a 64-bit register. 


34 33 32 31 30 29 28 27 26 25 24 23 22 21 20191817161514131211109 8 76543 2 1 0 


o rT 










































































ID s] L VM 
i | Esho 
RW PTW 

TRVM FMO 
HCD IMO 
TDZ AMO 
TGE VF 
TVM VI 

TTLB ————— — VSE 

TPU — —— FB 
TPC —— — BSU 
TSW — DC 

TACR —_—— — TWI 

TIDCP ———_____1 TWE 
TSC ————_J TIDO 
TID3 TID1 
TID2 








Figure B2-22 HCR_EL2 bit assignments 


[63:34] 
Reserved, RESO. 

ID, [33] 
Disables stage 2 instruction cache. When HCR_EL2.VM is 1, this forces all stage 2 translations 
for instruction accesses to Normal memory to be Non-cacheable for the EL1/ELO translation 
regimes. The possible values are: 


© Has no effect on stage 2 EL1/ELO translation regime for instruction accesses. This is the 
reset value. 
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1 Forces all stage 2 translations for instruction accesses to Normal memory to be Non- 
cacheable for the EL1/EL0 translation regime. 


CD, [32] 
Disables stage 2 data cache. When HCR_EL2.VM is 1, this forces all stage 2 translations for 
data accesses and translation table walks to Normal memory to be Non-cacheable for the 
EL1/ELO translation regimes. The possible values are: 


@ Has no effect on stage 2 EL1/ELO translation regime for data access or translation table 
walks. This is the reset value. 


1 Forces all stage 2 translations for data accesses and translation table walks to Normal 
memory to be Non-cacheable for the EL1/EL0 translation regime. 


RW, [31] 
Execution state control for lower exception levels. The possible values are: 
© Lower levels are all AArch32. This is the reset value. 


1 EL1 is AArch64. ELO is determined by the register width described in the current processing 
state when executing at ELO. 


TRVM, [30] 
Trap reads of Virtual Memory controls. The possible values are: 
© Non-secure EL1 reads are not trapped. This is the reset value. 


1 Non-secure EL1 reads are trapped to EL2. 


See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for the 
registers covered by this setting. 


HCD, [29] 
Reserved, RESO. 
TDZ, [28] 
Traps DC ZVA instruction. The possible values are: 
@ DC ZVA instruction is not trapped. This is the reset value. 


1 DC ZVA instruction is trapped to EL2 when executed in Non-secure EL1 or ELO. 


TGE, [27] 

Traps general exceptions. If this bit is set, and SCR_EL3.NS is set, then: 

e All Non-secure EL! exceptions are routed to EL2. 

e For Non-secure EL1, the SCTLR_ELI.M bit is treated as 0 regardless of its actual state other 
than the purpose of reading the bit. 

e The HCR_EL2.FMO, HCR_EL2.IMO, and HCR_EL2.AMO bits are treated as 1 regardless 
of their actual state other than for the purpose of reading the bits. 

e All virtual interrupts are disabled. 

e Any implementation defined mechanisms for signaling virtual interrupts are disabled. 

e An exception return to Non-secure EL] is treated as an illegal exception return. 


TVM, [26] 
Trap virtual memory controls. The possible values are: 


@ Non-secure EL1 writes are not trapped. This is the reset value. 
1 Non-secure EL1 writes are trapped to EL2. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for the 
registers covered by this setting. 


TTLB, [25] 
Traps TLB maintenance instructions. The possible values are: 


© Non-secure EL1 TLB maintenance instructions are not trapped. This is the reset value. 
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1 TLB maintenance instructions executed from Non-secure EL 1 that are not UNDEFINED are 
trapped to EL2. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for the 
registers covered by this setting. 
TPU, [24] 
Traps cache maintenance instructions to Point of Unification (POU). The possible values are: 
Ə Cache maintenance instructions are not trapped. This is the reset value. 


1 Cache maintenance instructions to the POU executed from Non-secure EL1 or ELO that are 
not UNDEFINED are trapped to EL2. 


See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for the 
registers covered by this setting. 

TPC, [23] 
Traps data or unified cache maintenance instructions to Point of Coherency (POC). The possible 
values are: 
© Data or unified cache maintenance instructions are not trapped. This is the reset value. 


1 Data or unified cache maintenance instructions by address to the POC executed from Non- 
secure EL1 or ELO that are not UNDEFINED are trapped to EL2. 


See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for the 
registers covered by this setting. 


TSW, [22] 
Traps data or unified cache maintenance instructions by Set or Way. The possible values are: 
@ Data or unified cache maintenance instructions are not trapped. This is the reset value. 


1 Data or unified cache maintenance instructions by Set or Way executed from Non-secure 
EL] that are not UNDEFINED are trapped to EL2.are not trapped. 


See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for the 
registers covered by this setting. 


TACR, [21] 
Traps Auxiliary Control registers. The possible values are: 
© Accesses to Auxiliary Control registers are not trapped. This is the reset value. 


1 Accesses to ACTLR in AArch32 state or the ACTLR_EL1 in the AArch64 state from Non- 
secure EL1 are trapped to EL2. 


TIDCP, [20] 
Trap Implementation Dependent functionality. When 1, this causes accesses to the following 
instruction set space executed from Non-secure EL1 to be trapped to EL2: 
AArch32 All CP15 MCR and MRC instructions as follows: 


e CRnis 9, Opcodel is 0 to 7, CRm is c0, cl, c2, c5, c6, c7, or c8, and Opcode? is 
0 to 7. 

e CRnis 10, Opcodel is 0 to 7, CRm is c0, cl, c4, or c8, and Opcode? is 0 to 7. 

e CRnis 11, Opcodel is 0 to 7, CRm is c0 to c8, or c15, and Opcode? is 0 to 7. 


AArch64 Reserved control space for IMPLEMENTATION DEFINED functionality. 


Accesses from ELO are UNDEFINED. The reset value is 0. 


TSC, [19] 
Traps SMC instruction. The possible values are: 


© SMC instruction in not trapped. This is the reset value. 
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1 SMC instruction executed in Non-secure EL] is trapped to EL2 for AArch32 and AArch64 
Execution states. 


TID3, [18] 
Traps ID group 3 registers. The possible values are: 
© ID group 3 register accesses are not trapped. This is the reset value. 
1 Reads to ID group 3 registers executed from Non-secure EL] are trapped to EL2. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for the 
registers covered by this setting. 


TID2, [17] 
Traps ID group 2 registers. The possible values are: 
© ID group 2 register accesses are not trapped. This is the reset value. 


1 Reads to ID group 2 registers and writes to CSSELR and CSSELR_EL executed from Non- 
secure EL1 or ELO, if not UNDEFINED, are trapped to EL2. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for the 
registers covered by this setting. 


TID1, [16] 
Traps ID group 1 registers. The possible values are: 
© ID group | register accesses are not trapped. This is the reset value. 
1 Reads to ID group lregisters executed from Non-secure EL1 are trapped to EL2. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for the 
registers covered by this setting. 


TIDO, [15] 
Traps ID group 0 registers. The possible values are: 
© ID group 0 register accesses are not trapped. This is the reset value. 
1 Reads to ID group 0 registers executed from Non-secure EL1 are trapped to EL2. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for the 
registers covered by this setting. 

TWE, [14] 
Traps WFE instruction if it would cause suspension of execution. For example, if there is no 
pending WFE event. The possible values are: 
© WFE instruction is not trapped. This is the reset value. 
1 WFE instruction executed in Non-secure EL1 or ELO is trapped to EL2 for AArch32 and 

AArch64 Execution states. 

TWI, [13] 
Traps WFI instruction if it causes suspension of execution. For example, if there is no pending 
WFI event. The possible values are: 
© WFI instruction is not trapped. This is the reset value. 


1 WFI instruction executed in Non-secure EL1 or ELO is trapped to EL2 for AArch32 and 
AArch64 Execution states. 
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DC, [12] 
Default cacheable. When this bit is set it causes: 
e SCTLR_ELI1.M to behave as 0 for all purposes other than reading the bit. 
e HCR_EL2.VM to behave as 1 for all purposes other than reading the bit. 


The memory type produced by the first stage of translation in Non-secure EL1 and ELO is Non- 
Shareable, Inner Write-Back Write-Allocate, Outer Write-Back Write-Allocate. The reset value 
is @. 

BSU, [11:10] 
Barrier shareability upgrade. Determines the minimum shareability domain that is supplied to 
any barrier executed from Non-secure EL1 or ELO. The possible values are: 


e@bee No effect. This is the reset value. 
@be1 Inner Shareable. 

@b1e Outer Shareable. 

@b11 Full system. 


This value is combined with the specified level of the barrier held in its instruction, according to 
the algorithm for combining shareability attributes. 


FB, [9] 
Forces broadcast. The possible values are: 
© Instructions are not broadcast. This is the reset value. 
1 Forces instruction broadcast within Inner Shareable domain when executing from Non- 
secure EL1. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for the 
instructions covered by this setting. 


VSE, [8] 
Virtual System Error/Asynchronous Abort. The possible values are: 


© Virtual System Error/Asynchronous Abort is not pending by this mechanism. This is the reset 
value. 


1 Virtual System Error/Asynchronous Abort is pending by this mechanism. 
The virtual System Error/Asynchronous Abort is enabled only when the HCR_EL2.AMO bit is 


set. 


VI [7] 
Virtual IRQ interrupt. The possible values are: 


© Virtual IRQ is not pending by this mechanism. This is the reset value. 
1 Virtual IRQ is pending by this mechanism. 
The virtual IRQ is enabled only when the HCR_EL2.IMO bit is set. 


VF, [6] 
Virtual FIQ interrupt. The possible values are: 


© Virtual FIQ is not pending by this mechanism. This is the reset value. 
1 Virtual FIQ is pending by this mechanism. 
The virtual FIQ is enabled only when the HCR_EL2.FMO bit is set. 


AMO, [5] 
Asynchronous abort and error interrupt routing. The possible values are: 
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Ə Asynchronous external Aborts and SError Interrupts while executing at exception levels 
lower than EL2 are not taken at EL2. Virtual System Error/Asynchronous Abort is disabled. 
This is the reset value. 


1 Asynchronous external Aborts and SError Interrupts while executing at EL2 or lower are 
taken in EL2 unless routed by SCTLR_EL3.EA bit to EL3. Virtual System Error/ 
Asynchronous Abort is enabled. 


IMO, [4] 
Physical IRQ routing. The possible values are: 
© Physical IRQ while executing at exception levels lower than EL2 are not taken at EL2. 
Virtual IRQ interrupt is disabled. This is the reset value. 


1 Physical IRQ while executing at EL2 or lower are taken in EL2 unless routed by 
SCTLR_EL3.IRQ bit to EL3. Virtual IRQ interrupt is enabled. 


FMO, [3] 
Physical FIQ routing. The possible values are: 
© Physical FIQ while executing at exception levels lower than EL2 are not taken at EL2. 
Virtual FIQ interrupt is disabled. This is the reset value. 


1 Physical FIQ while executing at EL2 or lower are taken in EL2 unless routed by 
SCTLR_EL3.FIQ bit to EL3. Virtual FIQ interrupt is enabled. 


PTW, [2] 
Protected Table Walk. When this bit is set, if the stage 2 translation of a translation table access, 
made as part of a stage | translation table walk at ELO or EL1, maps to Device memory, the 
access is faulted as a stage 2 Permission fault. The reset value is ©. 

SWIO, [1] 
Set/Way Invalidation Override. Non-secure EL1 execution of the data cache invalidate by 
set/way instruction is treated as data cache clean and invalidate by set/way. When this bit is set: 
e DCISW is treated as DCCISW when in the AArch32 Execution state. 
e DC ISW is treated as DC CISW when in the AArch64 Execution state. 


This bit is RES1. 


VM, [0] 
Enables second stage of translation. The possible values are: 


@ Disables second stage translation. This is the reset value. 


1 Enables second stage translation for execution in Non-secure EL1 and ELO. 


To access the HCR_EL2: 


MRS <Xt>, HCR_EL2 ; Read HCR_EL2 into Xt 
MSR HCR_EL2, <Xt> ; Write Xt to HCR_EL2 


Register access is encoded as follows: 


Table B2-41 HCR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 100 | 0001 | 0001 | 000 
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B2.49 Hypervisor IPA Fault Address Register, EL2 
The HPFAR_EL2 characteristics are: 


Purpose 

Holds the faulting IPA for some aborts on a stage 2 translation taken to EL2. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- J- [RW [RW RW 


























Configurations 
HPFAR EL2[31:0] is mapped to AArch32 register HPFAR. See B1.66 Hyp IPA Fault Address 
Register on page B1-243. 

Attributes 
HPFAR EL2 is a 64-bit register. 


63 40 39 43 0 


$f i$ 
RESO FIPA[47:12] RESO 


Figure B2-23 HPFAR_EL2 bit assignments 





[63:40] 
Reserved, RESO. 
FIPA [47:12], [39:4] 
Bits [47:12] of the faulting intermediate physical address. The equivalent upper bits in this field 
are RESO. 
[3:0] 
Reserved, RESO. 


To access the HPFAR_EL: 


MRS <Xt>, HPFAR_EL2 ; Read EL2 Fault Address Register 
MSR HPFAR_EL2, <Xt> ; Write EL2 Fault Address Register 


Register access is encoded as follows: 


Table B2-42 HPFR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 |0110 | 0000 | 100 
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B2.50 Hyp System Trap Register, EL2 
The HSTR_EL2 characteristics are: 


Purpose 

Controls access to ThumbEE and coprocessor registers at lower exception levels in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- J- [RW IRW RW 


























Configurations 
HSTR_EL2 is architecturally mapped to AArch32 register HSTR. See B/.69 Hyp System Trap 
Register on page B1-249. 

Attributes 
HSTR_EL2 is a 32-bit register. 


31 17 16 15 14 13 1211109876543210 





























Figure B2-24 HSTR_EL2 bit assignments 


[31:17] 
Reserved, RESO. 
TTEE, [16] 
Trap T32EE. This value is: 


©  132EE is not supported. 

T15, [15] 
Trap coprocessor primary register CRn = 15. The possible values are: 
© Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 15 to Hyp mode. 


The reset value is 0. 


[14] 
Reserved, RESO. 

T13, [13] 
Trap coprocessor primary register CRn = 13. The possible values are: 
© Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 13 to Hyp mode. 


The reset value is 0. 
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T12, [12] 


Trap coprocessor primary register CRn = 12. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 12 to Hyp mode. 


The reset value is 0. 


T11, [11] 


Trap coprocessor primary register CRn = 11. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 11 to Hyp mode. 


The reset value is 0. 


T10, [10] 


T9, [9] 


T8, [8] 


T7, [7] 


T6, [6] 


TS, [5] 


Trap coprocessor primary register CRn = 10. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 10 to Hyp mode. 


The reset value is 0. 


Trap coprocessor primary register CRn = 9. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 9 to Hyp mode. 


The reset value is 0. 


Trap coprocessor primary register CRn = 8. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 8 to Hyp mode. 


The reset value is 0. 


Trap coprocessor primary register CRn = 7. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 7 to Hyp mode. 


The reset value is 0. 


Trap coprocessor primary register CRn = 6. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 6 to Hyp mode. 


The reset value is 0. 


Trap coprocessor primary register CRn = 5. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 5 to Hyp mode. 


The reset value is 0. 
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[4] 
Reserved, RESO. 
T3, [3] 
Trap coprocessor primary register CRn = 3. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 3 to Hyp mode. 


The reset value is 0. 


T2, [2] 
Trap coprocessor primary register CRn = 2. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 2 to Hyp mode. 
The reset value is 0. 


T1, [1] 
Trap coprocessor primary register CRn = 1. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 1 to Hyp mode. 
The reset value is 0. 


TO, [0] 
Trap coprocessor primary register CRn = 0. The possible values are: 


© Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 0 to Hyp mode. 
The reset value is 0. 

To access the HSTR_EL2: 


MRS <Xt>, HSTR_EL2 ; Read HSTR_EL2 into Xt 
MSR HSTR_EL2, <Xt> ; Write Xt to HSTR_EL2 


Register access is encoded as follows: 


Table B2-43 HSTR_EL2 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 | 100 | 0001 |0001 | 011 
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B2.51 AArch64 Debug Feature Register 0, EL1 
The ID_AA64DFRO_ ELI characteristics are: 


Purpose 

Provides top level information of the debug system in the AArch64 Execution state. 
Usage constraints 

This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 
Configurations 
ID_AA64DFRO0_ELl! is architecturally mapped to external register EDDFR. 
Attributes 
ID_AA64DFRO0_ELIl1 is a 64-bit register. 
63 32 31 28 27 24 23 20 19 16 15 12 11 





Figure B2-25 ID_AA64DFR0_EL1 bit assignments 


[63:32] 
Reserved, RESO. 

CTX_CMPs, [31:28] 
Number of breakpoints that are context-aware, minus |. These are the highest numbered 
breakpoints: 


@beee1 Two breakpoints are context-aware. 
[27:24] 
Reserved, RESO. 


WRPs, [23:20] 
The number of watchpoints minus 1: 


@bee11 Four watchpoints. 
[19:16] 
Reserved, RESO. 


BRPs, [15:12] 
The number of breakpoints minus 1: 


0b0101 Six breakpoints. 


PMUver, [11:8] 

Performance Monitors Extension version. 

@beee1 Performance monitor system registers implemented, PMUv3. 
Tracever, [7:4] 

Trace extension: 

@beeee Trace system registers not implemented. 
Debugger, [3:0] 

Debug architecture version: 


@be11@ ARMv8-A debug architecture implemented. 
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To access the ID AA64DFRO_ ELI: 


MRS <Xt>, ID_AA64DFR@_EL1 ; Read ID_AA64DFR@_EL1 into Xt 


Register access is encoded as follows: 


B2 AArch64 system registers 
B2.51 AArch64 Debug Feature Register 0, EL1 


Table B2-44 ID_AA64DFRO_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 | 000 | 0000 |0101 | 000 
The EDDFR can be accessed through the external debug interface, offset @xD28. 
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B2.52  AArché64 Instruction Set Attribute Register 0, EL1 
The ID_AA64ISARO_ EL] characteristics are: 
Purpose 


Provides information about the optional cryptographic instructions that the processor can 
support. 


The optional Cryptographic engine is not included in the base product of the processor. ARM 

requires licensees to have contractual rights to obtain the Cortex-A35 Cryptographic engine. 
Usage constraints 

This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 
Attributes 
ID_AA64ISARO_ ELI is a 64-bit register. 
63 20 19 16 15 12 11 8 





7 4 3 0 
RESO cRca2 | saz | shat 


Figure B2-26 ID_AA64ISARO_EL1 bit assignments 
[63:20] 
Reserved, RESO. 
CRC372, [19:16] 


Indicates whether CRC32 instructions are implemented. 
@x1 CRC32 instructions are implemented. 
SHA2, [15:12] 
Indicates whether SHA2 instructions are implemented. The possible values are: 


@beeee No SHA2 instructions implemented. This is the value if the implementation does not 
include the Cryptographic Extension, or if it is disabled. 


@b@@@1 SHA256H, SHA256H2, SHA256U@, and SHA256U1 implemented. This is the value if the 
implementation includes the Cryptographic Extension. 


All other values reserved. 
SHA1, [11:8] 
Indicates whether SHA1 instructions are implemented. The possible values are: 


@beeee No SHA1 instructions implemented. This is the value if the implementation does not 
include the Cryptographic Extension. 


@b@@@1 SHA1C, SHA1P, SHA1M, SHA1SU@, and SHA1SU1 implemented. This is the value if the 
implementation includes the Cryptographic Extension. 


All other values reserved. 
AES, [7:4] 
Indicates whether AES instructions are implemented. The possible values are: 


@beeee No AES instructions implemented. This is the value if the implementation does not 
include the Cryptographic Extension. 
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@b@0@1@ AESE, AESD, AESMC, and AESIMC implemented, plus PMULL and PMULL2 instructions 


B2 AArch64 system registers 
B2.52 AArch64 Instruction Set Attribute Register 0, EL1 


operating on 64-bit data. This is the value if the implementation includes the 


Cryptographic Extension. 


All other values reserved. 


[3:0] 
Reserved, RESO. 


To access the ID AA64ISARO_ ELI: 


MRS <Xt>, ID_AA64ISAR@_EL1 ; Read ID_AA64ISAR@_EL1 into Xt 


Register access is encoded as follows: 


Table B2-45 ID_AA64ISARO_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 | 000 | 0000/0110 | 000 
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B2.53  AArch64 Memory Model Feature Register 0, EL1 
The ID AA64MMFRO ELI characteristics are: 


Purpose 
Provides information about the implemented memory model and memory management support 
in the AArch64 Execution state. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Attributes 
ID_AA64MMERO ELI is a 64-bit register. 


32 31 28 27 24 23 20 19 16 15 12 11 


63 
| RESO TGran64 | TGran16 |BigEndELO} SNSMem BigEnd ASIDBits | PARange 


Figure B2-27 ID_AA64MMFRO_EL1 bit assignments 





[63:32] 
Reserved, RESO. 
TGran4, [31:28] 
Support for 4B memory translation granule size: 


exe Indicates that the 4KB granule is supported. 


TGran64, [27:24] 
Support for 64KB memory translation granule size: 


exe Indicates that the 64KB granule is supported. 


TGranl16, [23:20] 
Support for 16KB memory translation granule size: 


@x1 Indicates that the 16KB granule is supported. 


BigEndELDO, [19:16] 
Mixed-endian support only at ELO. 


RESO 


SNSMem, [15:12] 
Secure versus Non-secure Memory distinction: 


@be001 Supports a distinction between Secure and Non-secure Memory. 
BigEnd, [11:8] 
Mixed-endian configuration support: 
@be001 Mixed-endian support. The SCTLR_ELx.EE and SCTLR_EL1.EOE bits are RW. 


ASIDBits, [7:4] 
Number of ASID bits: 


@bee1e 16 bits. 


PARange, [3:0] 
Physical address range supported: 
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@bee10 40 bits, ITB. 


To access the ID AA64MMFRO ELI: 


MRS <Xt>, ID_AA64MMFR@_EL1 ; Read ID_AA64MMFR@_EL1 into Xt 


Register access is encoded as follows: 


B2 AArch64 system registers 
B2.53 AArch64 Memory Model Feature Register 0, EL1 


Table B2-46 ID_AA64MMFRO_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 000 | 0000} 0111 | 000 
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B2.54 AArch64 Processor Feature Register 0, EL1 
The ID_AA64PFRO EL] characteristics are: 


Purpose 
Provides additional information about implemented processor features in AArch64. 


The optional Advanced SIMD and floating-point support is not included in the base product of 
the processor. ARM requires licensees to have contractual rights to obtain the Advanced SIMD 
and floating-point support. 


Usage constraints 
This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 
Configurations 
ID_AA64PFRO_ EL] is architecturally mapped to external register EDPFR. 
Attributes 
ID_AA64PFRO_EL! is a 64-bit register. 
63 28 27 24 23 20 19 16 15 12 11 





EL3 EL2 EL1 ELO 
E pasmo] re handling | handling | handling | handling 


Figure B2-28 ID_AA64PFR0_EL1 bit assignments 


[63:28] 

Reserved, RESO. 
GIC, [27:24] 

GIC CPU interface: 


@x® GIC CPU interface is disabled, GICCDISABLE is HIGH, or not implemented. 
ex1 GIC CPU interface is implemented and enabled, GICCDISABLE is low. 


AdvSIMD, [23:20] 
Advanced SIMD. The possible values are: 


exe Advanced SIMD is implemented. 
@xF Advanced SIMD is not implemented. 


The FP and AdvSIMD both take the same value, as both must be implemented, or neither. 


FP, [19:16] 
Floating-point. The possible values are: 


exe Floating-point is implemented. 
@xF Floating-point is not implemented. 
The FP and AdvSIMD both take the same value, as both must be implemented, or neither. 


EL3 handling, [15:12] 
EL3 exception handling: 


0x2 Instructions can be executed at EL3 in AArch64 or AArch32 state. 


EL2 handling, [11:8] 
EL2 exception handling: 
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0x2 Instructions can be executed at EL2 in AArch64 or AArch32 state. 


EL1 handling, [7:4] 
EL1 exception handling. The possible values are: 


0x2 Instructions can be executed at EL1 in AArch64 or AArch32 state. 


ELO handling, [3:0] 
ELO exception handling. The possible values are: 


0x2 Instructions can be executed at ELO in AArch64 or AArch32 state. 


To access the ID AA64PFRO ELI: 


MRS <Xt>, ID_AA64PFR@_EL1 ; Read ID_AA64PFR@_EL1 into Xt 


Register access is encoded as follows: 


Table B2-47 ID_AA64PFRO_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0000 | 0100 | 000 




















The EDPFR can be accessed through the external debug interface, offset @xD2e. 
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B2.55 AArch32 Auxiliary Feature Register 0, EL1 
ID_AFRO_EL1 


The processor does not implement ID_AFRO ELI. This register is always RESO. 
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B2.56 AArch32 Debug Feature Register 0, EL1 
The ID_DFRO ELI characteristics are: 


Purpose 

Provides top level information about the debug system in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_DFRO_EL1 is architecturally mapped to AArch32 register ID_DFRO. See B/.73 Debug 
Feature Register 0 on page B1-256. 


Attributes 
ID_DFRO_ELI is a 32-bit register. 
28 27 24 23 20 19 16 15 12 11 
Figure B2-29 ID_DFRO_EL1 bit assignments 
[31:28] 


Reserved, RESO. 
PerfMon, [27:24] 
Indicates support for performance monitor model: 


@x3 Support for Performance Monitor Unit version 3 (PMUV3) system registers. 


MProfDbg, [23:20] 
Indicates support for memory-mapped debug model for M profile processors: 


@x@ Processor does not support M profile Debug architecture. 


MMapTre, [19:16] 
Indicates support for memory-mapped trace model: 


@x@ ETM is not implemented. 
@x1 Support for ARM trace architecture, with memory-mapped access. 


In the Trace registers, the ETMIDR gives more information about the implementation. 


CopTre, [15:12] 
Indicates support for coprocessor-based trace model: 


@x@ Processor does not support ARM trace architecture with CP14 access. 
[11:8] 
Reserved, RESO. 


CopSDbg, [7:4] 
Indicates support for coprocessor-based Secure debug model: 


@x6 Processor supports v8 Debug architecture, with CP14 access. 
CopDbg, [3:0] 
Indicates support for coprocessor-based debug model: 


@x6 Processor supports v8 Debug architecture, with CP14 access. 
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To access the ID DFRO_ ELI: 


MRS <Xt>, ID_DFR@ EL1 ; Read ID_DFR@ EL1 into Xt 


Register access is encoded as follows: 


B2 AArch64 system registers 
B2.56 AArch32 Debug Feature Register 0, EL1 


Table B2-48 ID_DFRO_EL1 access encoding 





op0 | op1 


CRn 


CRm 


op2 








1111 | 000 





0000 





0001 


010 
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AArch32 Instruction Set Attribute Register 0, EL1 


The ID ISARO_EL1 characteristics are: 


Purpose 

Provides information about the instruction sets implemented by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_ISARO_EL1 is architecturally mapped to AArch32 register ID_ISARO. See 
B1.74 Instruction Set Attribute Register 0 on page B1-258. 

Attributes 
ID_ISARO_EL1 is a 32-bit register. 


31 28 27 24 23 20 19 16 15 12 11 8 7 43 0 





Figure B2-30 ID_ISARO_EL1 bit assignments 


[31:28] 
Reserved, RESO. 
Divide, [27:24] 
Indicates the implemented Divide instructions: 


@x2 e SDIV and UDIV in the T32 instruction set. 
e SDIV and UDIV in the A32 instruction set. 


Debug, [23:20] 
Indicates the implemented Debug instructions: 
6x1 BKPT. 
Coproc, [19:16] 
Indicates the implemented Coprocessor instructions: 


exe None implemented, except for separately attributed by the architecture including 
CP15, CP14, Advanced SIMD and floating-point. 


CmpBranch, [15:12] 
Indicates the implemented combined Compare and Branch instructions in the T32 instruction 
set: 


0x1 CBNZ and CBZ. 


Bitfield, [11:8] 
Indicates the implemented bit field instructions: 


Əx1 BFC, BFI, SBFX, and UBFX. 


BitCount, [7:4] 
Indicates the implemented Bit Counting instructions: 


0x1 CLZ. 


Swap, [3:0] 
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Indicates the implemented Swap instructions in the A32 instruction set: 


exe None implemented. 
To access the ID ISARO_ EL}: 
MRS <Xt>, ID_ISAR@_EL1 ; Read ID_ISAR@_EL1 into Xt 


Register access is encoded as follows: 


Table B2-49 ID_ISARO_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 | 000 |0000 |0010 | 000 
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AArch32 Instruction Set Attribute Register 1, EL1 


The ID ISAR1_ ELI characteristics are: 


Purpose 

Provides information about the instruction sets implemented by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_ISAR1_ ELI is architecturally mapped to AArch32 register ID_ISAR1. See 
B1.75 Instruction Set Attribute Register I on page B1-260. 

Attributes 
ID_ISARI1_ ELI is a 32-bit register. 


28 27 24 23 20 19 16 15 12 11 


Figure B2-31 ID_ISAR1_EL1 bit assignments 


Jazelle, [31:28] 
Indicates the implemented Jazelle state instructions: 


0x1 Adds the BXJ instruction, and the J bit in the PSR. This setting might indicate a trivial 
implementation of the Jazelle extension. 


Interwork, [27:24] 
Indicates the implemented Interworking instructions: 


0x3 ¢ The BX instruction, and the T bit in the PSR. 
¢ The BLX instruction. The PC loads have BX-like behavior. 
e Data-processing instructions in the A32 instruction set with the PC as the 
destination and the S bit clear, have Bx-like behavior. 


Immediate, [23:20] 
Indicates the implemented data-processing instructions with long immediates: 
@x1 e The MOVT instruction. 
e The MOV instruction encodings with zero-extended 16-bit immediates. 
e The T32 ADD and SUB instruction encodings with zero-extended 12-bit immediates, 
and other ADD, ADR, and SUB encodings cross-referenced by the pseudocode for 
those encodings. 


IfThen, [19:16] 
Indicates the implemented If-Then instructions in the T32 instruction set: 


@x1 The IT instructions, and the IT bits in the PSRs. 
Extend, [15:12] 
Indicates the implemented Extend instructions: 


@x2 e The SXTB, SXTH, UXTB, and UXTH instructions. 
e The SXTB16, SXTAB, SXTAB16, SXTAH, UXTB16, UXTAB, UXTAB16, and UXTAH 
instructions. 
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Except_AR, [11:8] 


B2 AArch64 system registers 
B2.58 AArch32 Instruction Set Attribute Register 1, EL1 


Indicates the implemented A profile exception-handling instructions: 


0x1 The SRS and RFE instructions, and the A profile forms of the CPS instruction. 


Except, [7:4] 


Indicates the implemented exception-handling instructions in the A32 instruction set: 


0x1 The LDM (exception return), LDM (user registers), and STM (user registers) instruction 


versions. 


Endian, [3:0] 
Indicates the implemented Endian instructions: 


@x1 The SETEND instruction, and the E bit in the PSRs. 


To access the ID ISAR1_ ELI: 


MRS <Xt>, ID_ISAR1_EL1 ; Read ID_ISAR1_EL1 into Xt 


Register access is encoded as follows: 


Table B2-50 ID_ISAR1_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 | 000 |0000 |0010 | 001 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B2-445 
reserved. 


Non-Confidential 


B2 AArch64 system registers 
B2.59 AArch32 Instruction Set Attribute Register 2, EL1 


B2.59 AArch32 Instruction Set Attribute Register 2, EL1 
The ID ISAR2_ EL] characteristics are: 


Purpose 

Provides information about the instruction sets implemented by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_ISAR2_ ELI is architecturally mapped to AArch32 register ID_ISAR2. See 
B1.76 Instruction Set Attribute Register 2 on page B1-262. 

Attributes 
ID_ISAR2_ ELI is a 32-bit register. 


28 27 24 23 20 19 16 15 12 11 


MultiAccessint — 
Figure B2-32 ID_ISAR2_EL1 bit assignments 


Reversal, [31:28] 
Indicates the implemented Reversal instructions: 


0x2 The REV, REV16, REVSH, and RBIT instructions. 


PSR_AR, [27:24] 
Indicates the implemented A and R profile instructions to manipulate the PSR: 


0x1 The MRS and MSR instructions, and the exception return forms of data-processing 
instructions. 


The exception return forms of the data-processing instructions are: 

e Inthe A32 instruction set, data-processing instructions with the PC as the destination and the 
S bit set. 

¢ Inthe T32 instruction set, the SUBS PC, LR, #N instruction. 


MultU, [23:20] 
Indicates the implemented advanced unsigned Multiply instructions: 


@x2 The UMULL, UMLAL and UMAAL instructions. 


Mult, [19:16] 
Indicates the implemented advanced signed Multiply instructions. 


0x3 e The SMULL and SMLAL instructions. 
e The SMLABB, SMLABT, SMLALBB, SMLALBT, SMLALTB, SMLALTT, SMLATB, SMLATT, 
SMLAWB, SMLAWT, SMULBB, SMULBT, SMULTB, SMULTT, SMULWB, SMULWT instructions, 
and the Q bit in the PSRs. 
e The SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, SMLSDX, SMLSLD, SMLSLDX, SMMLA, 
SMMLAR, SMMLS, SMMLSR, SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, and SMUSDX 
instructions. 


Mult, [15:12] 
Indicates the implemented additional Multiply instructions: 
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@x2 The MUL, MLA and MLS instructions. 


MultiAccessInt, [11:8] 
Indicates the support for interruptible multi-access instructions: 


exe No support. This means the LDM and STM instructions are not interruptible. 


MemHint, [7:4] 
Indicates the implemented memory hint instructions: 


0x4 The PLD instruction. 
The PLI instruction. 


The PLDW instruction. 


LoadStore, [3:0] 
Indicates the implemented additional load/store instructions: 


0x2 The LDRD and STRD instructions. 


The Load Acquire (LDAB, LDAH, LDA, LDAEXB, LDAEXH, LDAEX, and LDAEXD) and Store 
Release (STLB, STLH, STL, STLEXB, STLEXH, STLEX, and STLEXD) instructions. 


To access the ID_ISAR2_EL1: 
MRS <Xt>, ID_ISAR2_EL1 ; Read ID_ISAR2_EL1 into Xt 


Register access is encoded as follows: 


Table B2-51 ID_ISAR2_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 |000 |0000 |0010 |010 
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AArch32 Instruction Set Attribute Register 3, EL1 


The ID ISAR3_EL1 characteristics are: 


Purpose 

Provides information about the instruction sets implemented by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_ISAR3_ ELI is architecturally mapped to AArch32 register ID_ISAR3. See 
B1.77 Instruction Set Attribute Register 3 on page B1-264. 

Attributes 
ID_ISAR3_ ELI is a 32-bit register. 


28 27 24 23 20 19 16 15 12 11 


ThumbEE | TrueNOP |ThumbCopy| TabBranch E SIMD 


Figure B2-33 ID_ISAR3_EL1 bit assignments 


ThumbEE, [31:28] 
Indicates the implemented Thumb Execution Environment (T32EE) instructions: 


@xe None implemented. 
TrueNOP, [27:24] 
Indicates support for True NOP instructions: 
@x1 True NOP instructions in both the A32 and T32 instruction sets, and additional NOP- 
compatible hints. 
ThumbCopy, [23:20] 
Indicates the support for T32 non flag-setting MOV instructions: 
@x1 Support for T32 instruction set encoding T1 of the MOV (register) instruction, copying 
from a low register to a low register. 
TabBranch, [19:16] 
Indicates the implemented Table Branch instructions in the T32 instruction set. 
@x1 The TBB and TBH instructions. 
SynchPrim, [15:12] 
Indicates the implemented Synchronization Primitive instructions: 


@x2 e The LDREX and STREX instructions. 
e The CLREX, LDREXB, STREXB, and STREXH instructions. 
e The LDREXD and STREXD instructions. 


SVC, [11:8] 
Indicates the implemented SVC instructions: 


@x1 The SVC instruction. 


SIMD, [7:4] 
Indicates the implemented Single Instruction Multiple Data (SIMD) instructions. 
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0x3 e The SSAT and USAT instructions, and the Q bit in the PSRs. 
e The PKHBT, PKHTB, QADD16, QADD8, QASX, QSUB16, QSUB8, QSAX, SADD16, SADD8, 
SASX, SEL, SHADD16, SHADD8, SHASX, SHSUB16, SHSUB8, SHSAX, SSAT16, SSUB16, 
SSUB8, SSAX, SXTAB16, SXTB16, UADD16, UADD8, UASX, UHADD16, UHADD8, UHASX, 
UHSUB16, UHSUB8, UHSAX, UQADD16, UQADD8, UQASX, UQSUB16, UQSUB8, UQSAX, 
USAD8, USADA8, USAT16, USUB16, USUB8, USAX, UXTAB16, UXTB16 instructions, and 
the GE[3:0] bits in the PSRs. 


Saturate, [3:0] 
Indicates the implemented Saturate instructions: 


ex1 The QADD, QDADD, QDSUB, QSUB and the Q bit in the PSRs. 


To access the ID ISAR3_ ELI: 
MRS <Xt>, ID_ISAR3_EL1 ; Read ID_ISAR3_EL1 into Xt 


Register access is encoded as follows: 


Table B2-52 ID_ISAR3_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 |0000 |0010 | 011 























ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B2-449 
reserved. 
Non-Confidential 


B2 AArch64 system registers 
B2.61 AArch32 Instruction Set Attribute Register 4, EL1 


AArch32 Instruction Set Attribute Register 4, EL1 


The ID ISAR4 EL] characteristics are: 


Purpose 

Provides information about the instruction sets implemented by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_ISAR4 ELI is architecturally mapped to AArch32 register ID_ISAR4. See 
B1.78 Instruction Set Attribute Register 4 on page B1-266. 

Attributes 
ID_ISAR4 ELI is a 32-bit register. 


31 28 27 24 23 20 19 1615 12 11 8 7 4 3 0 





SynchPrim_frac — 


Figure B2-34 ID_ISAR4_EL1 bit assignments 


SWP_ frac, [31:28] 
Indicates support for the memory system locking the bus for SWP or SWPB instructions: 


@xe SWP and SWPB instructions not implemented. 

PSR_M, [27:24] 
Indicates the implemented M profile instructions to modify the PSRs: 
@xe None implemented. 

SynchPrim_frac, [23:20] 


This field is used with the ID_ISAR3.SynchPrim field to indicate the implemented 
Synchronization Primitive instructions: 


@x@ œ- The LDREX and STREX instructions. 
e The CLREX, LDREXB, LDREXH, STREXB, and STREXH instructions. 
e The LDREXD and STREXD instructions. 


Barrier, [19:16] 
Indicates the supported Barrier instructions in the A32 and T32 instruction sets: 


@x1 The DMB, DSB, and ISB barrier instructions. 


SMC, [15:12] 
Indicates the implemented SMC instructions: 
0x1 The SMC instruction. 
WriteBack, [11:8] 
Indicates the support for Write-Back addressing modes: 
0x1 Processor supports all of the Write-Back addressing modes defined in ARMv8. 


WithShifts, [7:4] 
Indicates the support for instructions with shifts. 
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0x4 e Support for shifts of loads and stores over the range LSL 0-3. 
e Support for other constant shift options, both on load/store and other instructions. 


e Support for register-controlled shift options. 


Unpriv, [3:0] 
Indicates the implemented unprivileged instructions. 


@x2 e The LDRBT, LDRT, STRBT, and STRT instructions. 
¢ The LDRHT, LDRSBT, LDRSHT, and STRHT instructions. 


To access the ID ISAR4 ELI: 


MRS <Xt>, ID_ISAR4_EL1 ; Read ID_ISAR4_EL1 into Xt 


Register access is encoded as follows: 


Table B2-53 ID_ISAR4_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 | 000 |0000 |0010 | 100 
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AArch32 Instruction Set Attribute Register 5, EL1 


The ID ISAR5_ EL] characteristics are: 


Purpose 
Provides information about the instruction sets that the processor implements. 


The optional Advanced SIMD and floating-point support is not included in the base product of 
the processor. ARM requires licensees to have contractual rights to obtain the Advanced SIMD 
and floating-point support. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_ISARS5_ ELI is architecturally mapped to AArch32 register ID_ISARS. See 
B1.79 Instruction Set Attribute Register 5 on page B1-268. 

Attributes 
ID_ISARS_ ELI is a 32-bit register. 


31 20 19 16 15 12 11 8 


7 4 3 0 


Figure B2-35 ID_ISAR5_EL1 bit assignments 


[31:20] 
Reserved, RESO. 
CRC32, [19:16] 
Indicates whether CRC32 instructions are implemented in AArch32 state: 


0x1 CRC32 instructions are implemented. 


SHA2, [15:12] 
Indicates whether SHA2 instructions are implemented in AArch32 state: 


exe Cryptographic Extensions are not implemented or are disabled. 

@x1 SHA256H, SHA256H2, SHA256SU@, and SHA256SU1 instructions are implemented. 
SHA1, [11:8] 

Indicates whether SHA1 instructions are implemented in AArch32 state: 


exe Cryptographic Extensions are not implemented or are disabled. 
@x1 SHA1C, SHA1P, SHA1M, SHA1H, SHA1SU@, and SHA1SU1 instructions are implemented. 





AES, [7:4] 
Indicates whether AES instructions are implemented in AArch32 state: 
exe Cryptographic Extensions are not implemented or are disabled. 
@x2 AESE, AESD, AESMC and AESIMC, plus PMULL and PMULL2 instructions operating on 64- 
bit data. 
SEVL, [3:0] 
Indicates whether the SEVL instruction is implemented: 
ex1 SEVL implemented to send event local. 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B2-452 
reserved. 


Non-Confidential 


To access the ID ISAR5S_ EL}: 


MRS <Xt>, ID_ISAR5_EL1 ; Read ID_ISAR5_EL1 into Xt 


Register access is encoded as follows: 


B2 AArch64 system registers 
B2.62 AArch32 Instruction Set Attribute Register 5, EL1 


Table B2-54 ID_ISAR5_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 000 | 0000 | 0010 | 101 
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AArch32 Memory Model Feature Register 0, EL1 


The ID MMFRO ELI characteristics are: 


Purpose 

Provides information about the memory model and memory management support in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_MMFRO EL] is architecturally mapped to AArch32 register ID_ MMFRO. See 
B1.80 Memory Model Feature Register 0 on page B1-270. 

Attributes 
ID_MMFRO EL] is a 32-bit register. 


28 27 24 23 20 19 16 15 12 11 


rose jason | tom | ShareLvi | outershr | Pusa | VMSA 


Figure B2-36 ID_MMFRO_EL1 bit assignments 


InnerShr, [31:28] 
Indicates the innermost shareability domain implemented: 


@x1 Implemented with hardware coherency support. 


FCSE, [27:24] 
Indicates support for Fast Context Switch Extension (FCSE): 


exe Not supported. 


AuxReg, [23:20] 
Indicates support for Auxiliary registers: 


0x2 Support for Auxiliary Fault Status Registers (AIFSR and ADFSR) and Auxiliary 
Control Register. 


TCM, [19:16] 
Indicates support for TCMs and associated DMAs: 


@xe Not supported. 


ShareLvl, [15:12] 
Indicates the number of shareability levels implemented: 


@x1 Two levels of shareability implemented. 


OuterShr, [11:8] 
Indicates the outermost shareability domain implemented: 


@x1 Implemented with hardware coherency support. 


PMSA, [7:4] 
Indicates support for a Protected Memory System Architecture (PMSA): 


@xe Not supported. 


VMSA, [3:0] 
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Indicates support for a Virtual Memory System Architecture (VMSA). 


0x5 Support for: 


e VMSAv7, with support for remapping and the Access flag. 


e The PXN bit in the Short-descriptor translation table format descriptors. 


e The Long-descriptor translation table format. 
To access the ID MMFRO ELI: 
MRS <Xt>, ID_MMFR@_EL1 ; Read ID_MMFR@_EL1 into Xt 


Register access is encoded as follows: 


Table B2-55 ID_MMFRO_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 | 000 |0000 |0001 | 100 
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B2.64 AArch32 Memory Model Feature Register 1, EL1 
The ID MMFRI_ ELI characteristics are: 


Purpose 

Provides information about the memory model and memory management support in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_MMEFRI ELI is architecturally mapped to AArch32 register ID MMFRI. See 
B1.81 Memory Model Feature Register 1 on page B1-272. 

Attributes 
ID_MMFRI EL] is a 32-bit register. 


28 27 24 23 20 19 1615 12 11 


L1TstCin L1Hvd L1UniSW | L1HvdSW | L1UniVA | L1HvdVA 


Figure B2-37 ID_MMFR1_EL1 bit assignments 


BPred, [31:28] 
Indicates branch predictor management requirements: 


0x4 For execution correctness, branch predictor requires no flushing at any time. 


L1TstCln, [27:24] 
Indicates the supported L1 Data cache test and clean operations, for Harvard or unified cache 
implementation: 


@xe None supported. 


L1Uni, [23:20] 
Indicates the supported entire L1 cache maintenance operations, for a unified cache 
implementation: 


exe None supported. 


L1Hvd, [19:16] 
Indicates the supported entire L1 cache maintenance operations, for a Harvard cache 
implementation: 


@xe None supported. 


L1UniSW, [15:12] 
Indicates the supported L1 cache line maintenance operations by set/way, for a unified cache 
implementation: 


exe None supported. 


L1HvdSW, [11:8] 
Indicates the supported L1 cache line maintenance operations by set/way, for a Harvard cache 
implementation: 


@xe None supported. 


L1UniVA, [7:4] 
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Indicates the supported L1 cache line maintenance operations by MVA, for a unified cache 


implementation: 


@xe None supported. 


LiHvdVA, [3:0] 


B2 AArch64 system registers 
B2.64 AArch32 Memory Model Feature Register 1, EL1 


Indicates the supported L1 cache line maintenance operations by MVA, for a Harvard cache 


implementation: 


exe None supported. 
To access the ID MMFRI1 ELI: 
MRS <Xt>, ID_MMFR1_EL1 ; Read ID_MMFR1_EL1 into Xt 


Register access is encoded as follows: 


Table B2-56 ID_.MMFR1_EL1 access encoding 





op0 | op1 


CRn 


CRm 


op2 








11 | 000 





0000 





0001 








101 
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AArch32 Memory Model Feature Register 2, EL1 


The ID MMFR2_ ELI characteristics are: 


Purpose 
Provides information about the implemented memory model and memory management support 
in AArch32. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_MMFR2 EL] is architecturally mapped to AArch32 register ID_ MMFR2. See 
B1.82 Memory Model Feature Register 2 on page B1-274. 

Attributes 
ID_MMFR2 EL] is a 32-bit register. 


28 27 24 23 20 19 1615 12 11 


HWAccFlg | WFIStall UniTLB HvdTLB |LL1HvdRng| L1HvdBG | L1HvdFG 


Figure B2-38 ID_MMFR2_EL1 bit assignments 


HWaAccFig, [31:28] 
Hardware access flag. Indicates support for a hardware access flag, as part of the VMSAv7 
implementation: 


@xe Not supported. 


WFIStall, [27:24] 
Wait For Interrupt Stall. Indicates the support for Wait For Interrupt (WFD) stalling: 


0x1 Support for WFI stalling. 


MemBarr, [23:20] 
Memory Barrier. Indicates the supported CP15 memory barrier operations. 
0x2 Supported CP15 memory barrier operations are: 
e Data Synchronization Barrier (DSB). 


e Instruction Synchronization Barrier (ISB). 
¢ Data Memory Barrier (DMB). 


UniTLB, [19:16] 
Unified TLB. Indicates the supported TLB maintenance operations, for a unified TLB 
implementation. 
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0x6 Supported unified TLB maintenance operations are: 

e Invalidate all entries in the TLB. 

¢ Invalidate TLB entry by MVA. 

¢ Invalidate TLB entries by ASID match. 

e Invalidate instruction TLB and data TLB entries by MVA All ASID. This is a 
shared unified TLB operation. 

¢ Invalidate Hyp mode unified TLB entry by MVA. 

e Invalidate entire Non-secure EL1 and ELO unified TLB. 

e Invalidate entire Hyp mode unified TLB. 

e TLBIMVALIS, TLBIMVAALIS, TLBIMVALHIS, TLBIMVAL, TLBIMVAAL, and TLBIMVALH. 

e TLBIIPAS2IS, TLBIIPAS2LIS, TLBIIPAS2, and TLBIIPAS2L. 


HvdTLB, [15:12] 
Harvard TLB. Indicates the supported TLB maintenance operations, for a Harvard TLB 
implementation: 


exe Not supported. 


LL1HvdRng, [11:8] 
L1 Harvard cache Range. Indicates the supported L1 cache maintenance range operations, for a 
Harvard cache implementation: 


exe Not supported. 


L1HvdBG, [7:4] 
L1 Harvard cache Background fetch. Indicates the supported L1 cache background prefetch 
operations, for a Harvard cache implementation: 


exe Not supported. 


L1HvdFG, [3:0] 
L1 Harvard cache Foreground fetch. Indicates the supported L1 cache foreground prefetch 
operations, for a Harvard cache implementation: 


@xe Not supported. 


To access the ID MMFR2 ELI: 


MRS <Xt>, ID_MMFR2_EL1 ; Read ID_MMFR2_EL1 into Xt 


Register access is encoded as follows: 


Table B2-57 ID_MMFR2_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 000 | 0000 | 0001 | 110 
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AArch32 Memory Model Feature Register 3, EL1 


The ID MMFR3_ELI characteristics are: 


Purpose 

Provides information about the memory model and memory management support in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_MMFR3_EL1 is architecturally mapped to AArch32 register ID_ MMFR3. See 
B1.83 Memory Model Feature Register 3 on page B1-276. 

Attributes 
ID_MMFR3_EL1 is a 32-bit register. 


31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 





Figure B2-39 ID_MMFR3_EL1 bit assignments 


Supersec, [31:28] 
Supersections. Indicates support for supersections: 


@xe Supersections supported. 


CMemsSz, [27:24] 
Cached memory size. Indicates the size of physical memory supported by the processor caches: 


0x2 1TByte, corresponding to a 40-bit physical address range. 


CohWalk, [23:20] 
Coherent walk. Indicates whether translation table updates require a clean to the point of 
unification: 


0x1 Updates to the translation tables do not require a clean to the point of unification to 
ensure visibility by subsequent translation table walks. 


[19:16] 
Reserved, RESO. 

MaintBest, [15:12] 
Maintenance broadcast. Indicates whether cache, TLB and branch predictor operations are 
broadcast: 


0x2 Cache, TLB and branch predictor operations affect structures according to shareability 
and defined behavior of instructions. 
BPMaint, [11:8] 
Branch predictor maintenance. Indicates the supported branch predictor maintenance operations. 


0x2 Supported branch predictor maintenance operations are: 


e Invalidate all branch predictors. 
e Invalidate branch predictors by MVA. 


CMaintSW, [7:4] 
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Cache maintenance by set/way. Indicates the supported cache maintenance operations by set/ 


way. 


0x1 Supported hierarchical cache maintenance operations by set/way are: 


CMaintVA, [3:0] 
Cache maintenance by MVA. Indicates the supported cache maintenance operations by MVA. 


Invalidate data cache by set/way. 
Clean data cache by set/way. 


Clean and invalidate data cache by set/way. 


0x1 Supported hierarchical cache maintenance operations by MVA are: 


Invalidate data cache by MVA. 


Invalidate data cache by MVA operations are treated as clean and invalidate data 
cache by MVA operations on the executing core. If the operation is broadcast to 
another core then it is broadcast as an invalidate data cache by MVA operation. 


Clean data cache by MVA. 


Clean and invalidate data cache by MVA. 


Invalidate instruction cache by MVA. 
Invalidate all instruction cache entries. 


To access the ID_MMFR3_EL1: 


MRS <Xt>, ID_MMFR3_EL1 ; Read ID_MMFR3_EL1 into Xt 


Register access is encoded as follows: 


Table B2-58 ID_MMFR3_EL1 access encoding 





op0 | op1 


CRn 


CRm 


op2 








11 | 000 





0000 





0001 
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B2.67 AArch32 Processor Feature Register 0, EL1 
The ID_PFRO ELI characteristics are: 


Purpose 

Gives top-level information about the instruction sets supported by the processor in AArch32. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_PFRO_EL1 is architecturally mapped to AArch32 register ID_PFRO. See B/.84 Processor 
Feature Register 0 on page B1-278. 

Attributes 
ID_PFRO_ ELI is a 32-bit register. 


31 16 15 12 11 8 


7 4 3 0 


Figure B2-40 ID_PFRO_EL1 bit assignments 


[31:16] 
Reserved, RESO. 
State3, [15:12] 
Indicates support for Thumb Execution Environment (T32EE) instruction set. This value is: 


exe Processor does not support the T32EE instruction set. 


State2, [11:8] 
Indicates support for Jazelle. This value is: 


0x1 Processor supports trivial implementation of Jazelle. 


State1, [7:4] 
Indicates support for T32 instruction set. This value is: 


0x3 Processor supports T32 encoding after the introduction of Thumb-2 technology, and 
for all 16-bit and 32-bit T32 basic instructions. 


State0, [3:0] 
Indicates support for A32 instruction set. This value is: 


@x1 A32 instruction set implemented. 


To access the ID PFRO ELI: 


MRS <Xt>, ID_PFR@_EL1 ; Read ID_PFR@_EL1 into Xt 
Register access is encoded as follows: 


Table B2-59 ID_PFRO_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 




















1111] 000 | 0000 | 0001 | 000 
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AArch32 Processor Feature Register 1, EL1 


The ID_PFRI ELI characteristics are: 


Purpose 
Provides information about the programmers model and architecture extensions supported by 
the processor. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ID_PFR1_ ELI is architecturally mapped to AArch32 register ID_PFR1. See B/.85 Processor 
Feature Register I on page B1-280. 

Attributes 
ID_PFRI1_ ELI is a 32-bit register. 


31 28 27 24 23 20 19 16 15 12 11 8 


7 4 3 0 


Virtualization — 
Figure B2-41 ID_PFR1_EL1 bit assignments 


GIC CPU, [31:28] 
GIC CPU support: 


@x® GIC CPU interface is disabled, GICCDISABLE is HIGH, or not implemented. 

0x1 GIC CPU interface is implemented and enabled, GICCDISABLE is LOW. 
[27:20] 

Reserved, RESO. 


GenTimer, [19:16] 
Generic Timer support: 


@x1 Generic Timer supported. 


Virtualization, [15:12] 
Virtualization support: 
0x1 Virtualization implemented. 
MProgMod, [11:8] 
M profile programmers' model support: 
@xe Not supported. 
Security, [7:4] 
Security support: 
0x1 Security implemented. This includes support for Monitor mode and the SMC 
instruction. 
ProgMod, [3:0] 
Indicates support for the standard programmers model for ARMv4 and later. 


Model must support User, FIQ, IRQ, Supervisor, Abort, Undefined, and System modes: 
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0x1 Supported. 


To access the ID_PFR1_EL1: 


MRS <Xt>, ID_PFR1_EL1 ; Read ID_PFR1_EL1 into Xt 


Register access is encoded as follows: 


B2 AArch64 system registers 
B2.68 AArch32 Processor Feature Register 1, EL1 


Table B2-60 ID_PFR1_EL1 access encoding 





op0 | op1 


CRn 


CRm 


op2 








1111 | 000 





0000 





0001 


001 
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B2.69 Instruction Fault Status Register, EL2 
The IFSR32_EL2 characteristics are: 


Purpose 
Allows access to the AArch32 IFSR register from AArch64 state only. Its value has no effect on 
execution in AArch64 state. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- J- [RW IRW RW 


























Configurations 
IFSR32_EL2 is architecturally mapped to AArch32 register IFSR(NS). See B/.87 Instruction 
Fault Status Register on page B1-283. 

Attributes 
IFSR32_EL2 is a 32-bit register. 


There are two formats for this register. The current translation table format determines which format of 
the register is used. 
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B2.70  IFSR32_EL2 with Short-descriptor translation table format 


IFSR32_EL32 has a specific format when using the Short-descriptor translation table format. 


The following figure shows the IFSR32_EL2 bit assignments when using the Short-descriptor translation 
table format. 


31 13121110 9 8 4 


3 0 


ExT—! L_FSj4] 
RESO 


Figure B2-42 IFSR32_EL2 bit assignments for Short-descriptor translation table format 


[31:13] 
Reserved, RESO. 
ExT, [12] 
External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 
(2) External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 


[11] 
Reserved, RESO. 
FS[4], [10] 
Part of the Fault Status field. See bits [3:0] in this table. 
[9] 
RAZ. 
[8:5] 
Reserved, RESO. 
FS[3:0], [4:0] 
Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is 





reserved. 

0b00010 Debug event. 

@beee11 Access flag fault, section. 

@bee101 Translation fault, section. 

@bee118 Access flag fault, page. 

@bee111 Translation fault, page. 

@be1000 Synchronous external abort, non-translation. 

@be1001 Domain fault, section. 

@be@1011 Domain fault, page. 

@be1100 Synchronous external abort on translation table walk, first level. 

@be1101 Permission Fault, Section. 

@be1112 Synchronous external abort on translation table walk, second Level. 

@b01111 Permission fault, page. 

0b10000 TLB conflict abort. 

0b11001 Synchronous parity error on memory access. 

0b11100 Synchronous parity error on translation table walk, first level. 

0b11110 Synchronous parity error on translation table walk, second level. 
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B2.71 IFSR32_EL2 with Long-descriptor translation table format 


IFSR32_EL32 has a specific format when using the Long-descriptor translation table format. 


The following figure shows the IFSR32_EL2 bit assignments when using the Long-descriptor translation 
table format. 


31 131211109 8 65 0 
| fast sen | see | 
L—ExT 


Figure B2-43 IFSR32_EL2 bit assignments for Long-descriptor translation table format 


[31:13] 
Reserved, RESO. 
ExT, [12] 
External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 
(2) External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 


[11:10] 
Reserved, RESO. 
[9] 
RAO. 
[8:6] 
Reserved, RESO. 
Status, [5:0] 
Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is 


























reserved. 
Ob000000 Address size fault in TTBRO or TTBR1. 
@bee@01LL Translation fault, LL bits indicate level. 
Ob0010LL Access fault flag, LL bits indicate level. 
Ob0O11LL Permission fault, LL bits indicate level. 
0b010000 Synchronous external abort. 
Ob0101LL Synchronous external abort on translation table walk, LL bits indicate 
level. 
0b011000 Synchronous parity error on memory access. 
0b0111LL Synchronous parity error on memory access on translation table walk, LL 
bits indicate level. 
0b100001 Alignment fault. 
0b100010 Debug event. 
0b110000 TLB conflict abort. 
Table B2-61 Encodings of LL bits associated with the MMU fault 
Bits | Meaning 
@be@ | Reserved 
Qb@1 | Level 1 
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Table B2-61 Encodings of LL bits associated with the MMU řault (continued) 





Bits 


Meaning 





@b10 


Level 2 





@b11 








Level 3 








If a Data Abort exception is generated by an instruction cache maintenance operation when the Long- 
descriptor translation table format is selected, the fault is reported as a Cache Maintenance fault in the 
DFSR or HSR with the appropriate Fault Status code. For such exceptions reported in the DFSR, the 


corresponding IFSR32_EL2 is UNKNOWN. 
To access the IFSR32_EL2: 


MRS <Xt>, IFSR32_EL2 ; Read IFSR32_EL2 into Xt 
MSR IFSR32_EL2, <Xt> ; Write Xt to IFSR32_EL2 


Register access is encoded as follows: 


Table B2-62 IFSR32_EL2 access encoding 





op0 | op1 


CRn 


CRm | op2 





11 | 000 








0101 | 0000 | 001 
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B2.72 Interrupt Status Register, EL1 
The ISR_ELI characteristics are: 


Purpose 
Shows whether an IRQ, FIQ, or external abort is pending. An indicated pending abort might be 
a physical abort or a virtual abort. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
ISR_ELI is architecturally mapped to AArch32 register ISR. See B/.90 Interrupt Status 
Register on page B1-287. 

Attributes 
ISR_ELI is a 32-bit register. 


31 98765 0 


ee cue 


Figure B2-44 ISR_EL1 bit assignments 


[31:9] 
Reserved, RESO. 
A, [8] 
External abort pending bit: 
© No pending external abort. 
1 An external abort is pending. 
I, [7] 
IRQ pending bit. Indicates whether an IRQ interrupt is pending: 
@ No pending IRQ. 
1 An IRQ interrupt is pending. 
F, [6] 
FIQ pending bit. Indicates whether an FIQ interrupt is pending: 
@ No pending FIQ. 
1 An FIQ interrupt is pending. 
[5:0] 


Reserved, RESO. 
To access the ISR_EL1: 


MRS <Xt>, ISR_EL1 ; Read ISR_EL1 into Xt 


Register access is encoded as follows: 


Table B2-63 ISR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 1100 | 0001 | 000 
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B2.73 L2 Auxiliary Control Register, EL1 
The LZACTLR_ ELI characteristics are: 


Purpose 


Provides configuration and control options for the L2 memory system. 
Usage constraints 


This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW |RW | RW | RW RW 


























The LZACTLR_ ELI: 


e This register can be written only when the L2 memory system is idle. ARM recommends 
that you write to this register after a powerup reset before the MMU is enabled and before 
any ACE, CHI or ACP traffic has begun. 


If the register must be modified after a powerup reset sequence, to idle the L2 memory 
system, you must take the following steps: 


1. Disable the MMU from each core followed by an ISB to ensure the MMU disable 
operation is complete, then followed by a DSB to drain previous memory transactions. 

2. Ensure that the system has no outstanding AC channel coherence requests to the 
Cortex-A35 processor. 


3. Ensure that the system has no outstanding ACP requests to the Cortex-A35 processor. 
When the L2 memory system is idle, the processor can update the LZAACTLR_EL1 followed by 
an ISB. After the L2ACTLR_EL1 is updated, the MMUs can be enabled and normal ACE and 
ACP traffic can resume. 
Configurations 
There is one copy of this register that is used in both Secure and Non-secure states. 


L2ACTLR_ ELI is mapped to the AArch32 L2ZACTLR register. See B/.9/ L2 Auxiliary Control 
Register on page B1-289. 


Attributes 
L2ACTLR_ ELI is a 32-bit register. 


31 30 29 28 25 24 15 14 13 4 3 2 0 


ai RESO i RESO i RESO || ses 


f — Lees 


L2 Victim Control 
Enable UniqueClean evictions with data 
Disable clean/evict push to external 


Figure B2-45 L2ACTLR_EL1 bit assignments 
[31:30] 
L2 Victim Control. 


@b1e@ This is the default value. Software must not change it. 


L2DEIEN, [29] 
L2 cache data RAM error injection enable. The possible values are: 





(3 Normal behavior, errors are not injected. This is the reset value. 
1 Double-bit errors are injected on all writes to the L2 cache data RAMs. 
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[28:25] 
Reserved, RESO. 
L2TEIEN, [24] 
L2 cache tag RAM error injection enable. The possible values are: 


7) Normal behavior, errors are not injected. This is the reset value. 

1 Double-bit errors are injected on all writes to the L2 cache tag RAMs. 
[23:15] 

Reserved, RESO. 


Enable UniqueClean evictions with data, [14] 
Enables sending of WriteEvict transactions for UniqueClean evictions with data. 


WriteEvict transactions update downstream caches that are outside the cluster. Enable 
WriteEvict transactions only if there is an L3 or system cache implemented in the system. 


The possible values are: 

(3 Disables UniqueClean evictions with data. This is the reset value for ACE. 
1 Enables UniqueClean evictions with data. This is the reset value for CHI. 
In AXI implementations, this field is REso. 


Some ACE interconnects might not support the WriteEvict transaction. You must not enable this 
bit if your interconnect does not support WriteEvict transactions. 


[13:4] 
Reserved, RESO. 

Disable clean/evict push to external, [3] 
Disables sending of Evict transactions for clean cache lines that are evicted from the processor. 
This is required only if the external interconnect contains a snoop filter that requires notification 
when the processor evicts the cache line. The possible values are: 


@ Enables clean/evict to be pushed out to external. This is the reset value for ACE. 
1 Disables clean/evict from being pushed to external. This is the reset value for CHI. 


In AXI implementations, this field is REs1. 


[2:0] 
Reserved, RESO. 


To access the LAACTLR_ELI: 


MRS Rt, S3_1_C15_C@ @; Read L2ACTLR_EL1 into Rt 
MSR S31 C15 C@ @, Rt; Write Rt to L2ACTLR_EL1 


Register access is encoded as follows: 


Table B2-64 L2ZACTLR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 001 | 1111 | 0000 | 000 
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B2.74 L2 Control Register, EL1 
The L2CTLR_ELI characteristics are: 


Purpose 

Provides IMPLEMENTATION DEFINED control options for the L2 memory system. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW | RW RW 


























L2CTLR_EL] is writable. However, all writes to this register are ignored. 


Configurations 


L2CTLR_ELI is mapped to the AArch32 L2CTLR register. See B/.92 L2 Control Register 
on page B1-291. 


There is one L2CTLR_EL1 for the Cortex-A35 processor. 


Attributes 
L2CTLR_ELI is a 32-bit register. 


26 25 24 23 22 21 20 6 5 4 


Number of a | | L2 Data RAM input latency- 
| SCU- L2 Cache Protection Reserved 
CPU Cache Protection L2 Data RAM output latency 
Figure B2-46 L2CTLR_EL1 bit assignments 
[31:26] 
Reserved, RESO. 
Number of cores, [25:24] 
Number of cores present: 
@bee@ One core, core 0. 
@b@1 Two cores, core 0 and core 1. 


@b1@ Three cores, cores 0 to 2. 
@b11 Four cores, cores 0 to 3. 


These bits are read-only and the value of this field is set to the number of cores present in the 
configuration. 


[23] 
Reserved, RESO. 
CPU Cache Protection, [22] 
CPU Cache Protection. Core RAMs are implemented: 


(3 Without ECC. 
1 With ECC. 
This field is RO. 


SCU-L2 Cache Protection, [21] 
SCU-L2 Cache Protection. L2 cache is implemented: 
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(3 Without ECC. 
1 With ECC. 
This field is RO. 


[20:6] 
Reserved, RESO. 
L2 data RAM input latency, [5] 
L2 data RAM input latency: 
(3 l-cycle input delay from L2 data RAMs. 


1 2-cycle input delay from L2 data RAMs. 


This field is RO. 


[4:1] 
Reserved, RESO. 

L2 data RAM output latency, [0] 
L2 data RAM output latency: 


B2 AArch64 system registers 
B2.74 L2 Control Register, EL1 


(3 2-cycle output delay from L2 data RAMs. 
1 3-cycle output delay from L2 data RAMs. 


This field is RO. 
To access the L2CTLR_EL1: 


MRS <Xt>, S3_1_C11_C@_2 ; Read L2CTLR_EL1 into Xt 
MSR S3_1_C11_C0_2, <Xt>; Write Xt to L2CTLR_EL1 


Register access is encoded as follows: 


Table B2-65 L2CTLR_EL1 access encoding 





























reserved. 
Non-Confidential 


op0 | op1 | CRn | CRm | op2 
11 001 | 1011 | 0000 | 010 
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B2.75 L2 Extended Control Register, EL1 
The L2ZECTLR_ELI characteristics are: 


Purpose 
Provides additional IMPLEMENTATION DEFINED control options for the L2 memory system. This 
register is used for dynamically changing, but implementation specific, control bits. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW [RW RW 


























The LZECTLR_ELI can be written dynamically. 


Configurations 
L2ECTLR_EL] is mapped to the AArch32 LZECTLR register. See B/.93 L2 Extended Control 
Register on page B1-293. 


There is one copy of this register that is used in both Secure and Non-secure states. 
There is one LAECTLR_EL1 for the Cortex-A35 processor. 


Attributes 
L2ECTLR_EL] is a 32-bit register. 


31 30 29 28 3210 
LAXI, ACE, or CHI asynchronous error L2 dynamic retention control- 
L2 internal asynchronous error 
RESO 


Figure B2-47 L2ECTLR_EL1 bit assignments 


[31] 
Reserved, RESO. 
L2 internal asynchronous error, [30] 
L2 internal asynchronous error caused by L2 RAM double-bit ECC error. The possible values 


are: 
(3 No pending asynchronous error. This is the reset value. 
1 An asynchronous error has occurred. 


A write of @ clears this bit and drives nINTERRIRQ HIGH. A write of 1 is ignored. 


AXI, ACE, or CHI asynchronous error, [29] 
AXI, ACE, or CHI asynchronous error indication. The possible values are: 


(3 No pending asynchronous error. 


1 An asynchronous error has occurred. 


A write of @ clears this bit and drives nEXTERRIRQ HIGH. A write of 1 is ignored. 


[28:3] 
Reserved, RESO. 
L2 dynamic retention control, [2:0] 
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L2 dynamic retention control. The possible values are: 


ebeee 
@be01 
@be10 
@be11 
0b100 
@b101 
0b110 
@b111 


L2 dynamic retention disabled. This is the reset value. 

2 Generic Timer ticks required before retention entry. 

8 Generic Timer ticks required before retention entry. 
32 Generic Timer ticks required before retention entry. 
64 Generic Timer ticks required before retention entry. 
128 Generic Timer ticks required before retention entry. 
256 Generic Timer ticks required before retention entry. 


512 Generic Timer ticks required before retention entry. 


To access the LAECTLR_EL1: 


MRS Rt, S3_1_C11_C@_3; Read L2ECTLR_EL1 into Rt 
MSR S31 C11 C@_3, Rt; Write Rt to L2ECTLR_EL1 


Register access is encoded as follows: 


Table B2-66 LZ2ECTLR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 001 | 1011 |0000 | 011 
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B2.76 L2 Memory Error Syndrome Register, EL1 
The L2MERRSR_ELI characteristics are: 


Purpose 
Holds information about ECC errors on the: 
e L2 data RAMs. 
e L2 tag RAMs. 
e SCU snoop filter RAMs. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- {RW [RW [RW | RW RW 


























Configurations 
The L2MERRSR_ELI is mapped to the AArch32 L2MERRSR register. See B/.94 L2 Memory 
Error Syndrome Register on page B1-295. 


There is one copy of this register that is used in both Secure and Non-secure states. 


A write of any value to the register updates the register to 0xee0e800000000000. 







Attributes 
L2MERRSR ELI is a 64-bit register. 
63 62 48 47 40 39 32 31 30 24 23 22 21181716 32 0 
| RESO Other erfor || Repeat error RAMID re | RAM address a 
count count 
L— Fatal Valid — CPUID/Way — L— Rres0 


Figure B2-48 L2MERRSR_EL1 bit assignments 


Fatal, [63] 
Fatal bit. This bit is set to 1 on the first memory error that caused a data abort. It is a sticky bit 
so that after it is set, it remains set until the register is written. 


The reset value is 0. 


[62:48] 
Reserved, RESO. 

Other error count, [47:40] 
This field is set to 0 on the first memory error and is incremented on any memory error that does 
not match the RAMID and Bank/Way information in this register while the sticky Valid bit is 
set. 


The reset value is 0. 


Repeat error count, [39:32] 
This field is set to 0 on the first memory error and is incremented on any memory error that 
exactly matches the RAMID and Bank/Way information in this register while the sticky Valid 
bit is set. 


The reset value is 0. 
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Valid, [31] 
Valid bit. This bit is set to 1 on the first memory error. It is a sticky bit so that after it is set, it 
remains set until the register is written. 


The reset value is 0. 


RAMID, [30:24] 
RAM Identifier. Indicates the RAM in which the first memory error occurred. The possible 
values are: 
0x10 L2 tag RAM. 
@x11 L2 data RAM. 
0x12 SCU snoop filter RAM. 


[23:22] 
Reserved, RESO. 
CPUID/Way, [21:18] 
Indicates the RAM where the first memory error occurred. 


L2 tag RAM 
@x® Way 0 
@x1 Way 1 
@x6 Way 6 
0x7 Way 7 

L2 data RAM 
@x® Bank 0 
@x1 Bank 1 
@x7 Bank 7 
@x8-e@x Unused 
F 

SCU snoop filter RAM 


@x® CPU0:Way0 
0x1 CPU0:Way1 


@xE CPU3:Way2 
@xF CPU3:Way3 


[17] 

Reserved, RESO. 
RAM address, [16:3] 

Indicates the index address of the first memory error. 
[2:0] 

Reserved, RESO. 


e A fatal error results in the RAMID, CPU ID/Way and RAM address recording the fatal error, even if 
the sticky bit was set. 

¢ Iftwo or more memory errors in the same RAM occur in the same cycle, only one error is reported. 

¢ Iftwo or more first memory error events from different RAMs occur in the same cycle, one of the 
errors is selected arbitrarily, while the Other error count field is incremented only by one. 

e Iftwo or more memory error events from different RAMs, that do not match the RAMID, bank, way, 
or index information in this register while the sticky Valid bit is set, occur in the same cycle, the 
Other error count field is incremented only by one. 
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To access the LIMERRSR_ELI: 


MRS <Xt>, S3_1_C15_C2_3 ; Read L2MERRSR_EL1 into Xt 
MSR S31 C15 C2_3, <Xt> ; Write Xt into L2MERRSR_EL1 


Register access is encoded as follows: 


B2 AArch64 system registers 
B2.76 L2 Memory Error Syndrome Register, EL1 


Table B2-67 L2MERRSR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 001 |1111 |0010 | O11 
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B2.77 Memory Attribute Indirection Register, EL1 
The MAIR ELI characteristics are: 


Purpose 
Provides the memory attribute encodings corresponding to the possible AttrIndx values in a 
Long-descriptor format translation table entry for stage 1 translations at EL1. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW [RW RW 


























MAIR _ ELI is permitted to be cached in a TLB. 


Configurations 
MAIR_EL1[31:0] is architecturally mapped to AArch32 register: 
e PRRR (NS) when TTBCR.EAE is 0. See B/./0/ Primary Region Remap Register 
on page B1-310. 
e MAIRO (NS) when TTBCR.EAE is 1. See B/.95 Memory Attribute Indirection Registers 0 
and I on page B1-298. 


MAIR _ EL1[63:32] is architecturally mapped to AArch32 register: 

e NMRR (NS) when TTBCR.EAE is 0. See B/.99 Normal Memory Remap Register 
on page B1-307. 

e MAIRI(NS) when TTBCR.EAE is 1. See B/.95 Memory Attribute Indirection Registers 0 
and I on page B1-298. 


Attributes 
MAIR ELI is a 64-bit register. 


56:55 48:47 40:39 32:31 24 23 16 15 


63 8 7 0 
Attr7 Attr6 Attr5 Attr4 Attr3 Attr2 Attr1 AttrO 
s$ 4 s$ s$ s$ 4 s$ 


9) 





Figure B2-49 MAIR_EL1 bit assignments 


Attr<n> is the memory attribute encoding for an AttrIndx[2:0] entry in a Long descriptor format 
translation table entry, where AttrIndx[2:0] gives the value of <n> in Attr<n>. 


Table B2-68 Attr<n>[7:4] bit assignments 





Bits Meaning 





ebeeee Device memory. See Table B2-69 Attr<n>[3:0] bit assignments on page B2-480 





ObOORW, RW not 00 | Normal Memory, Outer Write-through transient. The transient hint is ignored. 





0be100 Normal Memory, Outer Non-Cacheable. 





@bO1RW, RW not 0O | Normal Memory, Outer Write-back transient. The transient hint is ignored. 
































@b10RW Normal Memory, Outer Write-through non-transient. 
@b11RW Normal Memory, Outer Write-back non-transient. 
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Table B2-69 Attr<n>[3:0] bit assignments 





Bits 


Meaning when Attr<n>[7:4] is 0000 


Meaning when Attr<n>[7:4] is not 0000 





e@beeee 


Device-nGnRnE memory 


UNPREDICTABLE 





ObOORW, RW not 0O 


UNPREDICTABLE 


Normal Memory, Inner Write-through transient 





0b0100 


Device-nGnRE memory 


Normal memory, Inner Non-Cacheable 





ObOLRW, RW not 0O 


UNPREDICTABLE 


Normal Memory, Inner Write-back transient 





0b1000 


Device-nGRE memory 


Normal Memory, Inner Write-through non-transient (RW=00) 





@b1ORW, RW not 80 


UNPREDICTABLE 


Normal Memory, Inner Write-through non-transient 





0b1100 


Device-GRE memory 


Normal Memory, Inner Write-back non-transient (RW=00) 





@b11RW, RW not 80 





UNPREDICTABLE 














Normal Memory, Inner Write-back non-transient 








The following table shows the encoding of the R and W bits that are used, in some Attr<n> encodings in 
Table B2-69 Attr<n>[3:0] bit assignments on page B2-480 and Table B2-68 Attr<n>[7:4] bit 
assignments on page B2-479, to define the read-allocate and write-allocate policies: 


Table 


To access the MAIR _ ELI: 


B2-70 Encoding of R and W bits in some Attrm fields 





R or W | Meaning 





0 Do not allocate 














1 Allocate 





MRS <Xt>, MAIR_EL1 ; Read EL1 Memory Attribute Indirection Register 
MSR MAIR_EL1, <Xt> ; Write EL1 Memory Attribute Indirection Register 


Register access is encoded as follows: 


Table B2-71 MAIR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 |1010 |0010 | 000 
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B2.78 Memory Attribute Indirection Register, EL2 
The MAIR _EL2 characteristics are: 


Purpose 


B2 AArch64 system registers 
B2.78 Memory Attribute Indirection Register, EL2 


Provides the memory attribute encodings corresponding to the possible AttrIndx values in a 
Long-descriptor format translation table entry for stage 1 translations at EL2. 


Usage constraints 
This register is accessible as follows: 


























ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- J- [RW IRW RW 








MAIR _FI2 is permitted to be cached in a TLB. 


Configurations 


Attributes 
MAIR FI2 is a 64-bit register. 





MAIR_EL2[31:0] is architecturally mapped to AArch32 register HMAIRO. 
MAIR_ EL2[63:32] is architecturally mapped to AArch32 register HMAIR1. 


The MAIR _EL2 bit assignments follow the same pattern as described in B2.77 Memory Attribute 


Indirection Register, EL] on page B2-479. 
To access the MAIR_EL2: 


MRS <Xt>, MAIR_EL2 ; Read EL2 Memory Attribute Indirection Register 


MSR MAIR_EL2, <Xt> ; Write EL2 Memory Attribute Indirection Register 


Register access is encoded as follows: 


Table B2-72 MAIR_EL2 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 | 100 | 1010/0010 | 000 
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B2.79 Memory Attribute Indirection Register, EL3 
The MAIR _EL3 characteristics are: 


Purpose 


Configu 


Provides the memory attribute encodings corresponding to the possible AttrIndx values in a 


B2 AArch64 system registers 
B2.79 Memory Attribute Indirection Register, EL3 


Long-descriptor format translation table entry for stage 1 translations at EL3. 
Usage constraints 


This register is accessible as follows: 





ELO | EL1 | EL1| EL2 


EL3 EL3 


(SCR.NS = 1) | (SCR.NS = 0) 




















RW RW 











MAIR _EL2 is permitted to be cached in a TLB. 


rations 


MAIR_EL3[31:0] is mapped to AArch32 register PRRR (S) when TTBCR.EAE is 0. See 


B1.101 Primary Region Remap Register on page B1-310. 


MAIR_EL3[63:32] is mapped to AArch32 register NMRR (S) when TTBCR.EAE is 0. See 


B1.99 Normal Memory Remap Register on page B1-307. 


Attributes 


MAIR EL3 is a 64-bit register. 


The MAIR _EL3 bit assignments follow the same pattern as described in B2.77 Memory Attribute 


Indirecti 


on Register, ELI on page B2-479, 


To access the MAIR_EL3: 


MRS <Xt>, MAIR_EL3 ; Read EL3 Memory Attribute Indirection Register 
MSR MAIR_EL3, <Xt> ; Write EL3 Memory Attribute Indirection Register 


Register 


access is encoded as follows: 


Table B2-73 MAIR_EL3 access encoding 
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B2.80 Monitor Debug Configuration Register, EL2 
The MDCR_EL2 characteristics are: 


Purpose 
Provides EL2 configuration options for self-hosted debug and the Performance Monitors 
extension. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW | RW RW 


























Configurations 


e MDCR _EL2 is architecturally mapped to AArch32 register HDCR. See B/.63 Hyp Debug 
Control Register on page B1-238. 
e IfEL2 is not implemented, this register is RESO from EL3. 


Attributes 
MDCR_EL2 is a 32-bit register. 


31 1211109 8 765 4 











Figure B2-50 MDCR_EL2 bit assignments 


[31:12] 
Reserved, RESO. 
TDRA, [11] 
Trap debug ROM address register access. 
© Has no effect on accesses to debug ROM address registers from EL1 and ELO. 


1 Trap valid Non-secure EL1 and ELO access to debug ROM address registers to Hyp mode. 


When this bit is set to 1, any access to the following registers from EL1 or ELO is trapped to 
EL2: 


e AArch32: DBGDRAR, DBGDSAR. 
e AArch64: MDRAR ELI. 


If HCR_EL2.TGE is 1 or MDCR_EL2.TDE is 1, then this bit is ignored and treated as though it 
is | other than for the value read back from MDCR_EL2. 


On Warm reset, the field resets to 0. 


TDOSA, [10] 
Trap Debug OS-related register access: 


© Has no effect on accesses to OS-related debug registers. 
1 Trap valid Non-secure accesses to OS-related debug registers to EL2. 
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When this bit is set to 1, any access to the following registers from EL1 or ELO is trapped to 
EL2: 

e AArch32: DBGOSLAR, DBGOSLSR, DBGOSDLR, DBGPRCR. 

e AArch64: OSLAR EL1, OSLSR_EL1,OSDLR_EL1, DBGPRCR_ ELI. 


If HCR_EL2.TGE is 1 or MDCR_EL2.TDE is 1, then this bit is ignored and treated as though it 
is 1 other than for the value read back from MDCR_EL2. 


On Warm reset, the field resets to 0. 


TDA, [9] 


Trap Debug Access: 
© Has no effect on accesses to Debug registers. 


1 Trap valid Non-secure accesses to Debug registers to EL2. 


When this bit is set to 1, any valid Non-secure access to the debug registers from EL1 or ELO, 
other than the registers trapped by the TDRA and TDOSA bits, is trapped to EL2. 


If HCR_EL2.TGE is 1 or MDCR_EL2.TDE is1, then this bit is ignored and treated as though it 
is 1 other than for the value read back from MDCR_EL2. 


On Warm reset, the field resets to 0. 


TDE, [8] 


Trap software debug exceptions: 


© Has no effect on software debug exceptions. 


1 Route Software debug exceptions from Non-secure EL1 and ELO to EL2. Also enables traps 
on all debug register accesses to EL2. 


If HCR_EL2.TGE is 1, then this bit is ignored and treated as though it is 1 other than for the 
value read back from MDCR_EL2.This bit resets to 0. 


HPME, [7] 


Hypervisor Performance Monitor Enable: 
© EL2 performance monitor counters disabled. 


1 EL2 performance monitor counters enabled. 


When this bit is set to 1, the Performance Monitors counters that are reserved for use from EL2 
or Secure state are enabled. For more information see the description of the HPMN field. 


The reset value of this bit is UNKNOWN. 


TPM, [6] 


Trap Performance Monitor accesses: 


© Has no effect on performance monitor accesses. 


1 Trap Non-secure ELO and EL1 accesses to Performance Monitors registers that are not 
UNALLOCATED to EL2. 


This bit resets to 0. 


TPMCR, [5] 


Trap PMCR_ELO accesses: 

© Has no effect on PMCR_ELO accesses. 

1 Trap Non-secure ELO and EL1 accesses to PMCR_ELO to EL2. 
This bit resets to 0. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for 
more information. 
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HPMN, [4:0] 
Hyp Performance Monitor count. Defines the number of Performance Monitors counters that are 


accessible from Non-secure EL1 and ELO modes. 


In Non-secure state, HPMN divides the Performance Monitors counters as follows. For counter 


nin Non-secure state: 


For example, If PMnEVCNTR is performance monitor counter n then, in Non-secure state: 


¢ Ifn is in the range 0 < n < HPMN, the counter is accessible from EL1 and EL2, and from 
ELO if permitted by PMUSERENR_ELO. PMCR_ELO.E enables the operation of counters in 


this range. 
¢ There are six performance counters, specified by PMCR.N. 


If is in the range HPMN <n <6, the counter is accessible only from EL2. 


MDCR_EL2.HPME enables the operation of counters in this range. 


If the field is set to 0, then Non-secure ELO or EL1 has no access to any counters. 


If the field is set to a value greater than six, the behavior is the same as if the value is six. 


For reads of MDCR_EL2.HPMN by EL2 or higher, if this field is set to 0 or to a value larger 
than PMCR_ELO.N, the processor returns the value that was written to MDCR_EL2.HPMN. 


This field resets to @x6. 


To access the MDCR_EL2: 


MRS <Xt>, MDCR_EL2 ; Read MDCR_EL2 into Xt 
MSR MDCR_EL2, <Xt> ; Write Xt to MDCR_EL2 


Register access is encoded as follows: 


Table B2-74 MDCR_EL2 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 100 | 0001 | 0001 | 001 
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B2.81 Monitor Debug Configuration Register, EL3 
The MDCR_EL3 characteristics are: 


Purpose 

Provides configuration options for Security to self-hosted debug. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
= P z z RW RW 


























Configurations 
MDCR_EL3 is mapped to AArch32 register SDCR. See B/./06 Secure Debug Control Register 
on page B1-323. 

Attributes 
MDCR_EL3 is a 32-bit register. 


22 21 20 19 18 17 16 151413 11109 8 7 65 





EPMAD — L SPD32 Si TDA L- TPM 
EDAD Lo Ree 


SPME 


Figure B2-51 MDCR_EL3 bit assignments 


[31:22] 
Reserved, RESO. 
EPMAD, [21] 
External debugger access to Performance Monitors registers disabled. This disables access to 
these registers by an external debugger. The possible values are: 
© Access to Performance Monitors registers from external debugger is permitted. 


1 Access to Performance Monitors registers from external debugger is disabled, unless 
overridden by authentication interface. 


EDAD, [20] 
External debugger access to breakpoint and watchpoint registers disabled. This disables access 
to these registers by an external debugger. The possible values are: 
© Access to breakpoint and watchpoint registers from external debugger is permitted. 


1 Access to breakpoint and watchpoint registers from external debugger is disabled, unless 
overridden by authentication interface. 


[19:18] 
Reserved, RESO. 
SPME, [17] 
Secure performance monitors enable. This enables event counting exceptions from Secure state. 
The possible values are: 
@ Event counting prohibited in Secure state. This is the reset value. 


1 Event counting allowed in Secure state. 


SDD, [16] 
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AArch64 secure debug disable. Disables Software debug exceptions from Secure state if Secure 
EL] is using AArch64, other than from Software breakpoint instructions. The possible values 
are: 


© Debug exceptions from Secure ELO are enabled, and debug exceptions from Secure EL1 are 
enabled if MDSCR_EL1.KDE is 1 and PSTATE.D is 0. 


1 Debug exceptions from all exception levels in Secure state are disabled. 


The reset value is UNKNOWN. 


SPD32, [15:14] 
AArch32 secure privileged debug. Enables or disables debug exceptions from Secure state if 
Secure EL] is using AArch32, other than Software breakpoint instructions. The possible values 
are: 


@bee@ Legacy mode. Debug exceptions from Secure EL] are enabled only if 
AArch32SelfHostedSecurePrivilegedInvasiveDebugEnabled(). 


@b@1 Reserved. 
@b1@ Secure privileged debug disabled. Debug exceptions from Secure EL] are disabled. 
@b11 Secure privileged debug enabled. Debug exceptions from Secure EL1 are enabled. 


The reset value is UNKNOWN. 


[13:11] 
Reserved, RESO. 

TDOSA, [10] 
Trap accesses to the OS debug system registers, OSLAR_EL1, OSLSR_EL1, OSDLR_ELI, and 
DBGPRCR_ELI OS. 


Ə Accesses are not trapped. 


1 Accesses to the OS debug system registers are trapped to EL3. 


The reset value is UNKNOWN. 


TDA, [9] 
Trap accesses to the remaining sets of debug registers to EL3. 


© Accesses are not trapped. 


1 Accesses to the remaining debug system registers are trapped to EL3. 


The reset value is UNKNOWN. 


[8:7] 
Reserved, RESO. 
TPM, [6] 
Trap Performance Monitors accesses. The possible values are: 


© Accesses are not trapped. 
1 Accesses to the Performance Monitor registers are trapped to EL3. 
The reset value is UNKNOWN. 


[5:0] 
Reserved, RESO. 


To access the MDCR_EL3: 


MRS <Xt>, MDCR_EL3 ; Read EL3 Monitor Debug Configuration Register 
MSR MDCR_EL3, <Xt> ; Write EL3 Monitor Debug Configuration Register 


Register access is encoded as follows: 
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B2.81 Monitor Debug Configuration Register, EL3 


Table B2-75 MDCR_EL3 access encoding 





op0 | op1 


CRn 


CRm 


op2 








11 | 110 





0001 





0011 








001 
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B2 AArch64 system registers 
B2.82 Monitor Debug System Control Register, EL1 


B2.82 Monitor Debug System Control Register, EL1 
The MDSCR_ELI characteristics are: 


Purpose 

Main control register for the debug implementation. 
Usage constraints 

This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW | RW RW 
Configurations 
MDSCR_EL1I is architecturally mapped to AArch32 register DBGDSCRext. 
Attributes 
MDSCR_ELI is a 32-bit register. 
31 30 29 28 27 26 25 24 23 22 21201918 1615141312 11 765 





RESO sii e ERR 
RXfull TDCC 


TXfull KDE 
RESO HDE 
RXO MDE 
TXU 

RESO 

INTdis 

TDA 

RESO 

RAZ/WI 


Figure B2-52 MDSCR_EL1 bit assignments 


[31] 
Reserved, RESO. 
RXfull, [30] 
Used for save/restore of EDSCR.RX full 
e When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO, and software must 
treat it as UNK/SBZP. 
e When OSLSR_EL1.OSLK == 1 (the OS lock is locked), this bit is RW. 


TXfull, [29] 
Used for save/restore of EDSCR.RXfull 
e When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO, and software must 
treat it as UNK/SBZP. 
e When OSLSR_EL1.OSLK == 1 (the OS lock is locked), this bit is RW. 


[28] 
Reserved, RESO. 
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RXO, [27] 
Used for save/restore of EDSCR.RXO. 
e When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 
treat itas UNKNOWN and use an SBZP policy for writes. 
e When OSLSR_EL1.OSLK == 1 (the OS lock is locked), this bit is RW. 


TXU, [26] 
Used for save/restore of EDSCR.TXU. 
e When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 
treat itas UNKNOWN and use an SBZP policy for writes. 
e When OSLSR_ELI.OSLK == 1 (the OS lock is locked), this bit is RW. 


[25:24] 
Reserved, RESO. 
INTdis, [23:22] 
Used for save/restore of EDSCR.INTdis. 
e When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 
treat itas UNKNOWN and use an SBZP policy for writes. 
e When OSLSR_EL1.OSLK == 1 (the OS lock is locked), this bit is RW. 


TDA, [21] 
Used for save/restore of EDSCR.TDA. 


e When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 
treat itas UNKNOWN and use an SBZP policy for writes. 
e When OSLSR_EL1.OSLK == 1 (the OS lock is locked), this bit is RW. 


[20:19] 
Reserved, RESO. 
[18:16] 
Reserved, RAZ/WI. Hardware must implement this as RAZ/WI. Software must not rely on this 
property as the behavior of reserved values might change in a future revision of the architecture. 
MDE, [15] 
Monitor debug events. Enable Breakpoint, Watchpoint, and Vector catch debug exceptions. 
0 Breakpoint, Watchpoint, and Vector catch debug exceptions disabled. 


1 Breakpoint, Watchpoint, and Vector catch debug exceptions enabled. 


When this register has an architecturally-defined reset value, this field resets to a value that is 
architecturally UNKNOWN on Warm reset. 


HDE, [14] 
Used for save/restore of EDSCR.HDE. 


e When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 
treat itas UNKNOWN and use an SBZP policy for writes. 
e When OSLSR_EL1.OSLK == 1 (the OS lock is locked), this bit is RW. 


KDE, [13] 
Local (kernel) debug enable. If ELp is using AArch64, enable Software debug events within 
ELp. Permitted values are: 


0 Software debug events, other than Software breakpoint instructions, disabled within ELp. 
1 Software debug events enabled within ELp. 
RESO if ELp is using AArch32. 


When this register has an architecturally-defined reset value, this field resets to a value that is 
architecturally UNKNOWN on Warm reset. 


TDCC, [12] 
Traps ELO accesses to the DCC registers to EL1, from both Execution states: 
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B2 AArch64 system registers 
B2.82 Monitor Debug System Control Register, EL1 


0 ELO using AArch64: 
° ELO accesses to the MDCCSR_ELO, DBGDTR_EL0, DBGDTRTX_ELO, and 
DBGDTRRX_ELO registers are not trapped to EL1. 


ELO using AArch32: 
e ELO accesses to the DBGDSCRint, DBGDTRRXint, DBGDTRTXint, DBGDIDR, 
DBGDSAR, and DBGDRAR registers are not trapped to ELI. 


ELO using AArch64: 
° ELO accesses to the MDCCSR_ELO, DBGDTR_EL0, DBGDTRTX_ELO, and 
DBGDTRRX_ELO registers are trapped to EL1. 


ELO using AArch32: 
e ELO accesses to the DBGDSCRint, DBGDTRRXint, DBGDTRTXint, DBGDIDR, 
DBGDSAR, and DBGDRAR registers are trapped to EL1. 


— 


All accesses to these AArch32 registers are trapped, including LDC and STC accesses to 
DBGDTRTXint and DBGDTRRXint, and MRRC accesses to DBGDSAR and DBGDRAR. 


Traps of AArch32 PLO accesses to the DBGDTRRXint and DBGDTRTXint are ignored in 
Debug state. 


When this register has an architecturally-defined reset value, this field resets to a value that is 
architecturally UNKNOWN on Warm reset. 


[11:7] 
Reserved, RESO. 
ERR, [6] 
Used for save/restore of EDSCR.ERR. 


e When OSLSR_EL1.OSLK == 0 (the OS lock is unlocked), this bit is RO. Software must 
treat itas UNKNOWN and use an SBZP policy for writes. 
e When OSLSR_EL1.OSLK == 1 (the OS lock is locked), this bit is RW. 


[5:1] 
Reserved, RESO. 
SS, [0] 
Software step control bit. If ELp is using AArch64, enable Software step. Permitted values are: 


0 Software step is disabled. 
1 Software step is unabled. 


RESO if ELp is using AArch32. 


When this register has an architecturally-defined reset value, this field resets to a value that is 
architecturally UNKNOWN on Warm reset. 


To access the MDSCR_EL1: 


MRS <Xt>, MDSCR_EL1 ; Read MDSCR_EL1 into Xt 
MSR MDSCR_EL1, <Xt> ; Write Xt to MDSCR_EL1 


Register access is encoded as follows: 


Table B2-76 MDSCR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





10 | 000 | 0000 | 0010 | 010 
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Main ID Register, EL1 


The MIDR_ ELI characteristics are: 


Purpose 
Provides identification information for the processor, including an implementer code for the 
device and a device ID number. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
The MIDR ELl is: 
e Architecturally mapped to the AArch32 MIDR register. See B/.96 Main ID Register 
on page B1-301. 
e Architecturally mapped to external MIDR_EL1 register. 


Attributes 
MIDR_ ELI is a 32-bit register. 


31 24 23 20 19 1615 4 3 0 


Figure B2-53 MIDR_EL1 bit assignments 


Implementer, [31:24] 
Indicates the implementer code. This value is: 


@x41 ASCII character 'A' - implementer is ARM. 


Variant, [23:20] 
Indicates the variant number of the processor. This is the major revision number x in the rx part 
of the rxpy description of the product revision status. This value is: 


@x® r0p2. 


Architecture, [19:16] 
Indicates the architecture code. This value is: 


@xF Defined by CPUID scheme. 


PartNum, [15:4] 
Indicates the primary part number. This value is: 


@xD@4 Cortex-A35 processor. 


Revision, [3:0] 
Indicates the minor revision number of the processor. This is the minor revision number y in the 
py part of the rvpy description of the product revision status. This value is: 


@x2 r0p2. 


To access the MIDR_ELI: 


MRS <Xt>, MIDR_EL1 ; Read MIDR_EL1 into Xt 
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B2.83 Main ID Register, EL1 


Table B2-77 MIDR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 | 000 | 0000 | 0000 | 000 
The MIDR_ELI can be accessed through the external debug interface, offset @xDee. 
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B2.84 Multiprocessor Affinity Register, EL1 
The MPIDR_ELI characteristics are: 


Purpose 
Provides an additional core identification mechanism for scheduling purposes in a cluster 
system. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 
MPIDR_EL1[31:0] is: 
e Architecturally mapped to AArch32 register MPIDR. See B/.97 Multiprocessor Affinity 
Register on page B1-303. 
e Mapped to external register EDDEVAFFO. 
MPIDR_EL1[63:32] is: 
e Mapped to external register EDDEVAFF1. 


Attributes 
MPIDR_ EL] is a 64-bit register. 


40:39 32:31 30 29 25 24:23 16:15 
RESO Dii RESO e | ~ Ta 


Figure B2-54 MPIDR_EL1 bit assignments 


[63:40] 
Reserved, RESO. 
Aff3, [39:32] 
Affinity level 3. Highest level affinity field. 


Reserved, RESO. 


[31] 
Reserved, RESI. 
U, [30] 
Indicates a single core system, as distinct from core 0 in a cluster. This value is: 


(3 Processor is part of a multiprocessor system. This is the value for implementations 
with more than one core, and for implementations with an ACE or CHI master 
interface. 

1 Processor is part of a uniprocessor system. This is the value for single core 


implementations with an AXI master interface. 


[29:25] 
Reserved, RESO. 

MT, [24] 
Indicates whether the lowest level of affinity consists of logical cores that are implemented 
using a multi-threading type approach. This value is: 


(3 Performance of cores at the lowest affinity level is largely independent. 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B2-494 
reserved. 
Non-Confidential 
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B2.84 Multiprocessor Affinity Register, EL1 


Aff2, [23:16] 
Affinity level 2. Second highest level affinity field. 


Indicates the value read in the CLUSTERIDAFF?2 configuration signal. 


Aff1, [15:8] 
Affinity level 1. Third highest level affinity field. 


Indicates the value read in the CLUSTERIDAFF1 configuration signal. 


Aff0, [7:0] 
Affinity level 0. Lowest level affinity field. 


Indicates the core number in the Cortex-A35 processor. The possible values are: 


exe A cluster with one core only. 
@x®, @x1 A cluster with two cores. 
xð, 0x1, 0x2 A cluster with three cores. 


@x®, 0x1, 0x2, @x3 A cluster with four cores. 


To access the MPIDR_ELI: 


MRS <Xt>, MPIDR_EL1 ; Read MPIDR_EL1 into Xt 


Register access is encoded as follows: 


Table B2-78 MPIDR_EL1 access encoding 





op0 | op1 


CRn 


CRm 


op2 





11 |000 








0000 





0000 


101 











The EDDEVAFFO and EDDEVAFF! can be accessed through the external debug interface, offsets @xFA8 


and @xFAC respectively. 
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B2.85 Physical Address Register, EL1 
The PAR ELI characteristics are: 


Purpose 


The Physical Address returned from an address translation. 
Usage constraints 
This register is accessible as follows: 


Configurations 


B2 AArch64 system registers 
B2.85 Physical Address Register, EL1 




















ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW | RW | RW RW 














PAR_ELI is architecturally mapped to AArch32 register PAR(NS). See B/./00 Physical 
Address Register on page B1-309. 


Attributes 


PAR_ELI is a 64-bit register. 


The following figure shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 
conversion completes successfully. 


63 6059 5655 


48 47 


1211109 8 7 6 


RES1 
RESO 


LNS 


Figure B2-55 PAR_EL1 pass bit assignments 


The following list shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 
conversion completes successfully. 


AttrH, [63:60] 


Defines Normal or Device memory and outer cacheability. Must be used in conjunction with 
AttrL. The possible values are: 


@beee0 
0be100 
0b1000 
@b1001 
0b1010 
@b1011 


0b1100 
@b1101 
0b1110 
@b1111 


Device memory, see Attr[3:0]. 
Normal memory, Outer Non-cacheable. 


Allocate. 








Allocate. 


All other values are reserved. 


AttrL, [59:56] 


Normal memory, Outer Write-Through Cacheable. 

Normal memory, Outer Write-Through Cacheable, Outer Write-Allocate. 

Normal memory, Outer Write-Through Cacheable, Outer Read-Allocate. 

Normal memory, Outer Write-Through Cacheable, Outer WriteAllocate, Outer Read- 


Normal memory, Outer Write-Back Cacheable. 


Normal memory, Outer Write-Back Cacheable, Outer Write-Allocate. 
Normal memory, Outer Write-Back Cacheable, Outer Read-Allocate. 
Normal memory, Outer Write-Back Cacheable, Outer Write-Allocate, Outer Read- 


Defines Device memory, and Inner cacheability. Must be interpreted in conjunction with AttrH. 
The possible values are: 
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[55:48] 


B2 AArch64 system registers 
B2.85 Physical Address Register, EL1 
@beeee Device (nGnRnE) memory if AttrH is @b@00. Otherwise this value is reserved. 
0b01090 Device (not nGnRnE) memory if AttrH is @b@000. Otherwise, Normal memory, Inner 
Non-cacheable. 
0b1000 Reserved if AttrH is @b@000. Otherwise, Normal memory, Inner Write-Through 
Cacheable. 
@b1001 Reserved if AttrH is @b@000. Otherwise, Normal memory, Inner Write-Through 
Cacheable, Inner Write-Allocate. 
@b101@ Reserved if AttrH is @b@000. Otherwise, Normal memory, Inner Write-Through 
Cacheable, Inner Read-Allocate. 
@b1011 Reserved if AttrH is @b@000. Otherwise, Normal memory, Inner Write-Through 
Cacheable, Inner Write-Allocate, Inner Read-Allocate. 
@b11@@ Reserved if AttrH is @b@000. Otherwise, Normal memory, Inner Write-Back 
Cacheable. 
@b1101 Reserved if AttrH is @b@000. Otherwise, Normal memory, Inner Write-Back 
Cacheable, Inner Write-Allocate. 
@b111@ Reserved if AttrH is @b@000. Otherwise, Normal memory, Inner Write-Back 
Cacheable, Inner Read-Allocate. 


@b1111 Reserved if AttrH is @b@000. Otherwise, Normal memory, Inner Write-Through 
Cacheable, Inner Write-Allocate, Inner Read-Allocate. 








All other values are reserved. 


Reserved, RESO. 


PA, [47:12] 


[11] 
[10] 


NS, [9] 


Physical address. The Physical Address corresponding to the supplied Virtual Address. Returns 
address bits[47:12]. 


Reserved, RES1. 
Reserved, RESO. 


Non-secure. The NS attribute for a translation table entry read from Secure state. 


This bit is UNKNowN for a translation table entry from Non-secure state. 


SHA, [8:7] 


[6:1] 


F, [0] 


Shareability attribute for the Physical Address returned from a translation table entry. The 
possible values are: 


@bee => Non-shareable. 
@b@1 Reserved. 

@b18 Outer Shareable 
@b11 Inner Shareable. 
Takes the value of @b10 for: 


e Any type of device memory. 
e Normal memory with both Inner Non-cacheable and Outer-cacheable attributes. 


Reserved, RESO. 


Pass/Fail bit. Indicates whether the conversion completed successfully. This value is: 


(3 Virtual Address to Physical Address conversion completed successfully. 
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B2 AArch64 system registers 
B2.85 Physical Address Register, EL1 


The following figure shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 


conversion is aborted. 



































63 1211109 8 7 6 
RESO 
Figure B2-56 PAR_EL1 fail bit assignments 
The following list shows the PAR_EL] bit assignments when the Virtual Address to Physical Address 
conversion is aborted. 
[63:12] 
Reserved, RESO. 
[11] 
Reserved, RES1. 
[10] 
Reserved, RESO. 
S, [9] 
Stage of fault. Indicates the state where the translation aborted. The possible values are: 
(2) Translation aborted because of a fault in stage 1 translation. 
1 Translation aborted because of a fault in stage 2 translation. 
PTW, [8] 
Indicates a stage 2 fault during a stage 1 table walk. The possible values are: 
(3 No stage 2 fault during a stage 1 table walk. 
1 Translation aborted because of a stage 2 fault during a stage 1 table walk. 
[7] 
Reserved, RESO. 
FST, [6:1] 
Fault status code, as the Data Abort ESR encoding shows it. See the ARM Architecture 
Reference Manual ARMVv8, for ARMv8-A architecture profile for more information. 
F, [0] 
Pass/Fail bit. Indicates whether the conversion completed successfully. This value is: 
1 Virtual Address to Physical Address conversion aborted. 
To access the PAR_EL1: 
MRS <Xt>, PAR_EL1 ; Read EL1 Physical Address Register 
MSR PAR_EL1, <Xt> ; Write EL1 Physical Address Register 
Register access is encoded as follows: 
Table B2-79 PAR_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 | 000 | 0111 |0100 | 000 
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B2.86 Revision ID Register, EL1 
The REVIDR_ ELI characteristics are: 


Purpose 
Provides implementation-specific minor revision information that can be interpreted only in 
conjunction with the Main ID Register. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO IRO RO 


























Configurations 


REVIDR_ ELI is architecturally mapped to AArch32 register REVIDR. See B/./02 Revision ID 
Register on page B1-313. 

Attributes 
REVIDR_ELI is a 32-bit register. 


31 0 


Figure B2-57 REVIDR_EL1 bit assignments 
ID number, [31:0] 


Implementation-specific revision information. The reset value is determined by the specific 
Cortex-A35 processor implementation. 


0x000000090 Revision code is zero. 
To access the REVIDR_EL1: 
MRS <Xt>, REVIDR_EL1 ; Read REVIDR_EL1 into Xt 


Register access is encoded as follows: 


Table B2-80 REVIDR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0000 | 0000 | 110 
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B2.87 Reset Management Register, EL3 
The RMR_EL3 characteristics are: 


Purpose 

Controls the execution state that the processor boots into and allows request of a warm reset. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
= P z z RW RW 























Configurations 
The RMR_EL3 is architecturally mapped to the AArch32 RMR register. See B/./03 Reset 
Management Register on page B1-314. 





Attributes 
RMR _ EL3 is a 32-bit register. 
31 210 
Pm O 
RR— 
AA64 
Figure B2-58 RMR_EL3 bit assignments 

[31:2] 


Reserved, RESO. 
RR, [1] 
Reset Request. The possible values are: 
(3) This is the reset value. 
1 Requests a warm reset. This bit is set to 0 by either a cold or warm reset. 


The bit is strictly a request. 


AA64, [0] 
Determines which execution state the processor boots into after a warm reset. The possible 
values are: 


[2] AArch32 Execution state. 
1 AArch64 Execution state. 


The reset vector address on reset takes a choice between two values, depending on the value in 
the AA64 bit. This ensures that even with reprogramming of the AA64 bit, it is not possible to 
change the reset vector to go to a different location. 


The cold reset value depends on the AA64nAA32 signal. 
To access the RMR_EL3: 


MRS <Xt>, RMR_EL3 ; Read RMR_EL3 into Xt 
MSR RMR_EL3, <Xt> ; Write Xt to RMR_EL3 


Register access is encoded as follows: 
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Table B2-81 RMR_EL3 access encoding 





op0 | op1 


CRn 


CRm 


op2 








11 | 110 





1100 





0000 








010 
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B2.88 Reset Vector Base Address Register, EL3 


B2.88 Reset Vector Base Address Register, EL3 
The RVBAR_EL3 characteristics are: 


Purpose 
Contains the address that execution starts from after reset when executing in the AArch64 state. 


RVBAR EL3 is part of the Reset management registers functional group. 


Usage constraints 
This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
5 : - - RO RO 
Configurations 
There is no configuration information. 
Attributes 
RVBAR EL3 is a 64-bit register. 
63 0 





s$ 
Reset Vector Base Address 


Figure B2-59 RVBAR_EL3 bit assignments 


RVBA, [63:0] 
Reset Vector Base Address. The address that execution starts from after reset when executing in 
64-bit state. Bits[1:0] of this register are @b@@, as this address must be aligned, and bits [63:40] 
are 0x000000 because the address must be within the physical address size supported by the 
processor. 


To access the RVBAR_EL3: 


MRS <Xt>, RVBAR_EL3 ; Read RVBAR_EL3 into Xt 
Register access is encoded as follows: 


Table B2-82 RVBAR_EL3 access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 110 | 1100 |0000 | 001 
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Secure Configuration Register, EL3 


The SCR_EL3 characteristics are: 


Purpose 
Defines the configuration of the security state. SCR_EL3 specifies: 
e Security state of ELO and ELI, either Secure or Non-secure. 
e Register width at lower exception levels. 
e The exception level that the processor takes exceptions at, if an IRQ, FIQ, or external abort 
occurs. 


SCR_EL3 is part of the Security registers functional group. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
a ile |e |e RW RW 


























Configurations 
SCR_EL3 is mapped to AArch32 register SCR. See B/./04 Secure Configuration Register 
on page B1-316. 

Attributes 
SCR_EL3 is a 32-bit register. 


14131211109 8 76543 2 1 














RESO 
EA 
FIQ 
IRQ 
NS 























Figure B2-60 SCR_EL3 bit assignments 


[31:14] 
Reserved, RESO. 
TWE, [13] 
Traps WFE instructions. The possible values are: 
© WFE instructions are not trapped. This is the reset value. 
1 WFE instructions executed in AArch32 or AArch64 from EL2, EL1, or ELO are trapped to 
EL3 if the instruction would otherwise cause suspension of execution, that is if: 
e The event register is not set. 
e There is not a pending WFE wakeup event. 
¢ The instruction is not trapped at EL2 or ELI. 
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B2.89 Secure Configuration Register, EL3 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for 
more information. 


TWI, [12] 
Traps WFI instructions. The possible values are: 
© WFI instructions are not trapped. This is the reset value. 


1 WFI instructions executed in AArch32 or AArch64 from EL2, EL1, or ELO are trapped to 
EL3 if the instruction would otherwise cause suspension of execution, that is if there is not a 
pending WFI wakeup event and the instruction is not trapped at EL2 or EL1. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for 
more information. 


ST, [11] 
Enable Secure EL1 access to CNTPS_TVAL_EL1, CNTS_CTL_EL1, and CNTPS_CVAL EL1 
registers. The possible values are: 
© Registers accessible only in EL3. This is the reset value. 
1 Registers accessible in EL3 and EL1 when SCR_EL3.NS is 0. 


RW, [10] 
Execution state control for lower exception levels. The possible values are: 
© Lower levels are all AArch32. This is the reset value. 
1 The next lower level is AArch64. 


SIF, [9] 
Secure Instruction Fetch. When the processor is in Secure state, this bit disables instruction 
fetches from Non-secure memory. The possible values are: 
© Secure state instruction fetches from Non-secure memory are permitted. This is the reset 
value. 


1 Secure state instruction fetches from Non-secure memory are not permitted. 


HCE, [8] 
Hyp Call enable. This bit enables the use of HVC instructions. The possible values are: 
© The HVC instruction is UNDEFINED at all exception levels. This is the reset value. 
1 The HVC instruction is enabled at EL1, EL2 or EL3. 


SMD, [7] 
SMC instruction disable. The possible values are: 
© The SMC instruction is enabled at EL1, EL2, and EL3. This is the reset value. 


1 The SMC instruction is UNDEFINED at all exception levels. At EL1, in the Non-secure state, the 
HCR_EL2.TSC bit has priority over this control. 


[6] 
Reserved, RESO. 
[5:4] 
Reserved, RES1. 
EA, [3] 
External Abort and SError interrupt Routing. This bit controls which mode takes external aborts. 
The possible values are: 


@ External Aborts and SError Interrupts while executing at exception levels other than EL3 are 
not taken in EL3. This is the reset value. 


1 External Aborts and SError Interrupts while executing at all exception levels are taken in 
EL3. 


FIQ, [2] 
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B2 AArch64 system registers 
B2.89 Secure Configuration Register, EL3 


Physical FIQ Routing. The possible values ares: 


© Physical FIQ while executing at exception levels other than EL3 are not taken in EL3. This is 
the reset value. 


1 Physical FIQ while executing at all exception levels are taken in EL3. 


IRQ, [1] 
Physical IRQ Routing. The possible values are: 
© Physical IRQ while executing at exception levels other than EL3 are not taken in EL3. 
1 Physical IRQ while executing at all exception levels are taken in EL3. 
NS, [0] 
Non-secure bit. The possible values are. The possible values are: 


© ELO and EL] are in Secure state, memory accesses from those exception levels can access 
Secure memory. This is the reset value. 


1 ELO and ELI are in Non-secure state, memory accesses from those exception levels cannot 
access Secure memory. 


To access the SCR_EL3: 


MRS <Xt>, SCR_EL3 ; Read SCR_EL3 into Xt 
MSR SCR_EL3, <Xt> ; Write Xt to SCR_EL3 


Register access is encoded as follows: 


Table B2-83 SCR_EL3 access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 110 | 0001 |0001 | 000 
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B2.90 System Control Register, EL1 
The SCTLR_ELI characteristics are: 


Purpose 


Provides top level control of the system, including its memory system at EL1. 


SCTLR_ELI is part of the Virtual memory control registers functional group. 


Usage constraints 


This register is accessible as follows: 


B2 AArch64 system registers 
B2.90 System Control Register, EL1 




















ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW | RW | RW RW 














Configurations 
SCTLR_ELI is architecturally mapped to AArch32 register SCTLR(NS) See B/./05 System 


Control Register on page B1-319. 


Attributes 


[31:30] 


[29:28] 


[27] 


SCTLR_ELI is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16.15 14 13 1211 109 8 76543210 





ial =| 
UCI RES1 

EE WXN 
EOE nTWE 























RESO 

nTWI 

UCT 
DZE RESO 
RESO RES1 


Lsa 
SAO 
CP15BEN 


THEE 


Figure B2-61 SCTLR_EL1 bit assignments 


Reserved, RESO. 
Reserved, RES1. 


Reserved, RESO. 


UCI, [26] 
Enables ELO access to the DC CVAU, DC CIVAC, DC CVAC and IC IVAU instructions in the 


EE, [25] 


AArch64 Execution state. The possible values are: 


(7) ELO access disabled. This is the reset value. 
1 ELO access enabled. 


Exception endianness. The value of this bit controls the endianness for explicit data accesses at 
ELI. This value also indicates the endianness of the translation table data for translation table 


lookups. The possible values of this bit are: 
(2) Little-endian. 
1 Big-endian. 


The reset value of this bit is determined by the CFGEND configuration pin. 
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B2 AArch64 system registers 
B2.90 System Control Register, EL1 


EOE, [24] 
Endianness of explicit data access at ELO. The possible values are: 
(3 Explicit data accesses at ELO are little-endian. This is reset value. 
1 Explicit data accesses at ELO are big-endian. 
[23:22] 
Reserved, RESI. 
[21] 
Reserved, RESO. 
[20] 


Reserved, RES1. 

WXN, [19] 
Write permission implies Execute Never (XN). This bit can be used to require all memory 
regions with write permissions to be treated as XN. The possible values are: 


@ Regions with write permission are not forced XN. This is the reset value. 
1 Regions with write permissions are forced XN. 
nTWE, [18] 


WFE non-trapping. The possible values are: 
(2) A WFE instruction executed at ELO, that, if this bit was set to 1, would permit entry to a 
low-power state, is trapped to EL1. 
1 WFE instructions executed as normal. This is the reset value. 
[17] 
Reserved, RESO. 


nTWI, [16] 
WFI non-trapping. The possible values are: 





(2) A WFI instruction executed at ELO, that, if this bit was set to 1, would permit entry to a 
low-power state, is trapped to EL1. 
1 WFI instructions executed as normal. This is the reset value. 
UCT, [15] 
Enables ELO access to the CTR_ELO register in AArch64 Execution state. The possible values 
are: 
(3 Disables ELO access to the CTR_ELO register. This is the reset value. 
1 Enables ELO access to the CTR_ELO register. 
DZE, [14] 
Enables access to the DC ZVA instruction at ELO. The possible values are: 
(3 Disables execution access to the DC ZVA instruction at ELO. The instruction is 
trapped to EL1. This is the reset value. 
1 Enables execution access to the DC ZVA instruction at ELO. 
[13] 
Reserved, RESO. 
I, [12] 
Instruction cache enable. The possible values are: 
(3 Instruction caches disabled. This is the reset value. 
1 Instruction caches enabled. 
[11] 
Reserved, RES1. 
[10] 
Reserved, RESO. 
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B2 AArch64 system registers 
B2.90 System Control Register, EL1 


UMA, [9] 
User Mask Access. Controls access to interrupt masks from ELO, when ELO is using AArché4. 
The possible values of this bit are: 


(3 Disable access to the interrupt masks from ELO. 
1 Enable access to the interrupt masks from ELO. 
SED, [8] 
SETEND instruction disable. The possible values are: 
(3 The SETEND instruction is enabled. This is the reset value. 
1 The SETEND instruction is UNDEFINED. 
ITD, [7] 
IT instruction disable. The possible values are: 
(3 The IT instruction functionality is enabled. This is the reset value. 
1 All encodings of the IT instruction with hw1[3:0]!=1000 are UNDEFINED and treated as 


unallocated. All encodings of the subsequent instruction with the following values for 
hwl are UNDEFINED (and treated as unallocated): 


11XXXXXXXXXXXXXX All 32-bit instructions, B(2), B(1), Undefined, SVC, Load/Store 
multiple 

1x11xxxxxxxxxxxx Miscellaneous 16-bit instructions 

1x10@xxxxxxxxxx ADD Rd, PC, #imm 

@1001xxxxxxxxxxx LDR Rd, [PC, #imm] 

@10@x1xxx1111xxx ADD(4),CMP(3), MOV, BX pc, BLX pc 

@10001xx1xxxx111 ADD(4),CMP(3), MOV 


Contrary to the standard treatment of conditional UNDEFINED instructions in the ARM 
architecture, in this case these instructions are always treated as UNDEFINED, regardless 
of whether the instruction would pass or fail its condition codes as a result of being in 
an IT block. 


THEE, [6] 
RESO T32EE is not implemented. 


CP15BEN, [5] 
CP15 barrier enable. The possible values are: 





(3 CP15 barrier operations disabled. Their encodings are UNDEFINED. 
1 CP15 barrier operations enabled. This is the reset value. 

SAO, [4] 
Enable ELO stack alignment check. The possible values are: 
(3 Disable ELO stack alignment check. 
1 Enable ELO stack alignment check. This is the reset value. 

SA, [3] 
Enable SP alignment check. The possible values are: 
(3 Disable SP alignment check. 
1 Enable SP alignment check. This is the reset value. 

C, [2] 
Cache enable. The possible values are: 
(3 Data and unified caches disabled. This is the reset value. 
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1 Data and unified caches enabled. 
A, [1] 
Alignment check enable. The possible values are: 
(3 Alignment fault checking disabled. This is the reset value. 
1 Alignment fault checking enabled. 
M, [0] 


MMU enable. The possible values are: 


@ ELI and ELO stage 1 MMU disabled. This is the reset value. 


1 ELI and ELO stage 1 MMU enabled. 


To access the SCTLR_EL1: 


MRS <Xt>, SCTLR_EL1 ; Read SCTLR_EL1 into Xt 
MSR SCTLR_EL1, <Xt> ; Write Xt to SCTLR_EL1 


Register access is encoded as follows: 


B2 AArch64 system registers 


B2.90 System Control Register, EL1 


Table B2-84 SCTLR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 | 000 | 0001 | 0000 | 000 
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B2.91 System Control Register, EL2 


B2.91 System Control Register, EL2 
The SCTLR_EL2 characteristics are: 


Purpose 
Provides top level control of the system, including its memory system at EL2. 
SCTLR_EL2 is part of: 
e The Virtual memory control registers functional group. 
¢ The Hypervisor and virtualization registers functional group. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- f- J- [RW IRW RW 


























Configurations 
SCTLR_EL2 is architecturally mapped to AArch32 register HSCTLR. See B/.67 Hyp System 
Control Register on page B1-244. 





Attributes 

SCTLR_EL2 is a 32-bit register. 

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 6543210 
EE! Lreso WXN- Lres1 Lres1 LSA 
RES1 RESO 
Figure B2-62 SCTLR_EL2 bit assignments 

[31:30] 

Reserved, RESO. 
[29:28] 

Reserved, RESI. 
[27:26] 

Reserved, RESO. 
EE, [25] 

Exception endianness. The possible values are: 

(2) Little endian. 

1 Big endian. 


The reset value depends on the value of the CFGEND configuration input. 





[24] 
Reserved, RESO. 

[23:22] 
Reserved, RES1. 

[21:20] 
Reserved, RESO. 

WXN, [19] 
Force treatment of all memory regions with write permissions as XN. The possible values are: 
(3 Regions with write permissions are not forced XN. This is the reset value. 
1 Regions with write permissions are forced XN. 
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B2 AArch64 system registers 
B2.91 System Control Register, EL2 


[18] 

Reserved, RESI. 
[17] 

Reserved, RESO. 
[16] 


Reserved, RESI. 
[15:13] 
Reserved, RESO. 


I, [12] 
Instruction cache enable. The possible values are: 
(2) Instruction caches disabled. This is the reset value. 
1 Instruction caches enabled. 
[11] 
Reserved, RESI. 
[10:6] 
Reserved, RESO. 
[5:4] 


Reserved, RESI. 
SA, [3] 
Enables stack alignment check. The possible values are: 


(3 Disables stack alignment check. 
1 Enables stack alignment check. This is the reset value. 
C, [2] 
Global enable for data and unifies caches. The possible values are: 
@ Disables data and unified caches. This is the reset value. 
1 Enables data and unified caches. 
A, [1] 
Enable alignment fault check The possible values are: 
7) Disables alignment fault checking. This is the reset value. 
1 Enables alignment fault checking. 
M, [0] 
Global enable for the EL2 MMU. The possible values are: 
@ Disables EL2 MMU. This is the reset value. 
1 Enables EL2 MMU. 


To access the SCTLR_EL2: 


MRS <Xt>, SCTLR_EL2 ; Read SCTLR_EL2 into Xt 
MSR SCTLR_EL2, <Xt> ; Write Xt to SCTLR_EL2 


Register access is encoded as follows: 


Table B2-85 SCTLR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 | 0001 | 0000 | 000 
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B2.92 System Control Register, EL3 


B2.92 System Control Register, EL3 
The SCTLR_EL3 characteristics are: 


Purpose 
Provides top level control of the system, including its memory system at EL3. 


SCTLR_EL3 is part of the Virtual memory control registers functional group. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
z = - - RW RW 


























Configurations 
SCTLR_EL3 is mapped to AArch32 register SCTLR(S). See B/./05 System Control Register 
on page B1-319. 

Attributes 
SCTLR_EL3 is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 201918171615 131211109 8 76543 210 





EE Lreso wxn— L RES1 L RES1 | 
RES1 RESO SA 


Figure B2-63 SCTLR_EL3 bit assignments 


[31:30] 
Reserved, RESO. 
[29:28] 
Reserved, RES1. 
[27:26] 
Reserved, RESO. 
EE, [25] 
Exception endianness. This bit controls the endianness for: 
e Explicit data accesses at EL3. 
e Stage 1 translation table walks at EL3. 


The possible values are: 


© Little endian. This is the reset value. 


1 Big endian. 


[24] 
Reserved, RESO. 
[23:22] 
Reserved, RES1. 
[21:20] 
Reserved, RESO. 
WXN, [19] 
Force treatment of all memory regions with write permissions as XN. The possible values are: 


@ Regions with write permissions are not forced XN. This is the reset value. 
1 Regions with write permissions are forced XN. 
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B2 AArch64 system registers 
B2.92 System Control Register, EL3 


[18] 

Reserved, RESI. 
[17] 

Reserved, RESO. 
[16] 


Reserved, RESI. 
[15:13] 
Reserved, RESO. 


I, [12] 
Global instruction cache enable. The possible values are: 
@ Instruction caches disabled. This is the reset value. 
1 Instruction caches enabled. 
[11] 
Reserved, RES1. 
[10:6] 
Reserved, RESO. 
[5:4] 


Reserved, RES1. 

SA, [3] 
Enables stack alignment check. The possible values are: 
@ Disables stack alignment check. 


1 Enables stack alignment check. This is the reset value. 


C, [2] 
Global enable for data and unifies caches. The possible values are: 
@ Disables data and unified caches. This is the reset value. 
1 Enables data and unified caches. 
A, [1] 
Enable alignment fault check The possible values are: 
© Disables alignment fault checking. This is the reset value. 
1 Enables alignment fault checking. 
M, [0] 


Global enable for the EL3 MMU. The possible values are: 


@ Disables EL3 MMU. This is the reset value. 
1 Enables EL3 MMU. 


To access the SCTLR_EL3: 


MRS <Xt>, SCTLR_EL3 ; Read SCTLR_EL3 into Xt 
MSR SCTLR_EL3, <Xt> ; Write Xt to SCTLR_EL3 


Register access is encoded as follows: 


Table B2-86 SCTLR_EL3 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 110 | 0001 | 0000 | 000 
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B2 AArch64 system registers 
B2.93 Secure Debug Enable Register, EL3 


Secure Debug Enable Register, EL3 


The SDER32_EL3 characteristics are: 


Purpose 
Allows access to the AArch32 register SDER only from AArch64 state. Its value has no effect 
on execution in AArch64 state. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
z z 5 7 RW RW 


























Configurations 
SDER32_EL3 is architecturally mapped to AArch32 register SDER. See B1.107 Secure Debug 
Enable Register on page B1-325. 


Attributes 
SDER32_EL3 is a 32-bit register. 
31 210 
mT 
SUNIDEN | 
SUIDEN 
Figure B2-64 SDER32_EL3 bit assignments 

[31:2] 


Reserved, RESO. 
SUNIDEN, [1] 
Secure User Non-invasive Debug Enable The possible values are: 


© Non-invasive debug not permitted in Secure ELO mode. This is the Warm reset value. 
1 Non-invasive debug permitted in Secure ELO mode. 
SUIDEN, [0] 
Secure User Invasive Debug Enable. The possible values are: 
© Invasive debug not permitted in Secure ELO mode. This is the Warm reset value. 


1 Invasive debug permitted in Secure ELO mode. 


To access the SDER32_EL3: 


MRS <Xt>, SDER32_EL3 ; Read SDER32_EL3 into Xt 
MSR SDER32_EL3, <Xt> ; Write Xt to SDER32_EL3 
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B2 AArch64 system registers 
B2.94 Translation Control Register, EL1 


B2.94 Translation Control Register, EL1 
The TCR_ELI characteristics are: 


Purpose 
Determines which Translation Base Registers defines the base address register for a translation 
table walk required for stage 1 translation of a memory access from ELO or EL1 and holds 
cacheability and shareability information. 


TCR_ELI is part of the Virtual memory control registers functional group. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- {RW [RW [RW [RW RW 


























Configurations 
TCR_ELI is architecturally mapped to AArch32 register TTBCR(NS). See B/.//0 Translation 
Table Base Control Register on page B1-328. 

Attributes 
TCR_ELI is a 64-bit register. 


39 38 37 36 35 34 32 31 30 29 28 27 26 25 24 23 22 21 1615 14131211109 8 5 


i RESO ORGN1 ca L RESO 
| oR e EPDO 
TBIO a IRGNO 


Figure B2-65 TCR_EL1 bit assignments 


[63:39] 
Reserved, RESO. 

TBI, [38] 
Top Byte Ignored. Indicates whether the top byte of the input address is used for address match 
for the TTBR1 ELI region. The possible values are: 


(3 Top byte used in the address calculation. 
1 Top byte ignored in the address calculation. 
TBIO, [37] 


Top Byte Ignored. Indicates whether the top byte of the input address is used for address match 
for the TTBRO ELI region. The possible values are: 


(3 Top byte used in the address calculation. 

1 Top byte ignored in the address calculation. 
AS, [36] 

ASID size. The possible values are: 

(3 8-bit. 

1 16-bit. 


[35] 
Reserved, RESO. 
IPS, [34:32] 
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B2 AArch64 system registers 
B2.94 Translation Control Register, EL1 


Intermediate Physical Address Size. The possible values are: 
@beee 32 bits, 4GB. 

@bee1 36 bits, 64GB. 

@be1e 40 bits, 1TB. 


All other values are reserved. 


TG1, [31:30] 
TTBRI1_ EL! granule size. The possible values are: 


@bee Reserved. 


b10 4KB. 
@be1 16KB. 
@b11 64KB. 


All other values are not supported. 


SH1, [29:28] 
Shareability attribute for memory associated with translation table walks using TTBR1_EL1. 
The possible values are: 


@be@  Non-shareable. 
@b@1 Reserved. 

@b1@ Outer shareable. 
@b11 Inner shareable. 


ORGNI, [27:26] 
Outer cacheability attribute for memory associated with translation table walks using 
TTBR1_EL1. The possible values are: 
@bee@ Normal memory, Outer Non-cacheable. 
@b@1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b1@ Normal memory, Outer Write-Through Cacheable. 
@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


IRGN1, [25:24] 
Inner cacheability attribute for memory associated with translation table walks using 
TTBR1_ELI. The possible values are: 
@bee@ Normal memory, Inner Non-cacheable. 
@b@1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
@b1@ Normal memory, Inner Write-Through Cacheable. 
@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


EPD1, [23] 
Translation table walk disable for translations using TTBR1_EL1. Controls whether a 
translation table walk is performed on a TLB miss for an address that is translated using 
TTBR1_EL1. The possible values are: 





(3 Perform translation table walk using TTBR1_ELl1. 
1 A TLB miss on an address translated from TTBR1_EL1 generates a Translation fault. 
No translation table walk is performed. 
Al, [22] 
Selects whether TTBRO_EL1 or TTBR1_EL1 defines the ASID. The possible values are: 
(3 TTBRO_EL1.ASID defines the ASID. 
1 TTBR1_EL1.ASID defines the ASID. 
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TISZ, [21:16] 


B2 AArch64 system registers 
B2.94 Translation Control Register, EL1 


Size offset of the memory region addressed by TTBR1_EL1. The region size is 24T!S4) bytes. 


TGO, [15:14] 


TTBRO_ EL] granule size. The possible values are: 


@bee 
@b10 
@be1 
@b11 


4KB. 
16KB. 
64KB. 


Reserved. 


All other values are not supported. 


SHO, [13:12] 


Shareability attribute for memory associated with translation table walks using TTBRO_EL1. 
The possible values are: 


@bee 
@be1 
@b10 
@b11 


Non-shareable. 
Reserved. 
Outer shareable. 


Inner shareable. 


ORGNDO, [11:10] 
Outer cacheability attribute for memory associated with translation table walks using 
TTBRO_EL1. The possible values are: 


e@bee 
@be1 
@b10 
@b11 


IRGNO, [9:8] 


Normal memory, Outer Non-cacheable. 

Normal memory, Outer Write-Back Write-Allocate Cacheable. 
Normal memory, Outer Write-Through Cacheable. 

Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


Inner cacheability attribute for memory associated with translation table walks using 
TTBRO_EL1. The possible values are: 


@bee 
@be1 
@b10 
@b11 


EPDO, [7] 


Normal memory, Inner Non-cacheable. 

Normal memory, Inner Write-Back Write-Allocate Cacheable. 
Normal memory, Inner Write-Through Cacheable. 

Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


Translation table walk disable for translations using TTBRO_EL1. Controls whether a 
translation table walk is performed on a TLB miss for an address that is translated using 
TTBRO_EL1. The possible values are: 


2) 
1 


[6] 


Perform translation table walk using TTBRO_ ELI. 


A TLB miss on an address translated from TTBRO_EL1 generates a Translation fault. 
No translation table walk is performed. 


Reserved, RESO. 


TOSZ, [5:0] 


Size offset of the memory region addressed by TTBRO_EL1. The region size is 241°S4) bytes. 
To access the TCR_EL1: 


MRS <Xt>, TCR_EL1 ; Read TCR_EL1 into Xt 
MSR TCR_EL1, <Xt> ; Write Xt to TCR_EL1 


Register access is encoded as follows: 
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B2 AArch64 system registers 
B2.94 Translation Control Register, EL1 


Table B2-87 TCR_EL1 access encoding 





























op0 | op1 | CRn | CRm | op2 
11 000 | 0010 | 0000 | 010 
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B2.95 Translation Control Register, EL2 
The TCR_EL2 characteristics are: 


Purpose 
Controls translation table walks required for stage 1 translation of a memory access from EL2 
and holds cacheability and shareability information. 
TCR_EL2 is part of: 
e The Virtual memory control registers functional group. 
¢ The Hypervisor and virtualization registers functional group. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- J- [RW IRW RW 


























Configurations 
TCR_EL2 is architecturally mapped to AArch32 register HCTR. See B/.70 Hyp Translation 
Control Register on page B1-252. 

Attributes 
TCR_EL2 is a 32-bit register. 


31 30 24 23 2221201918 161514131211109 8 7 6 5 0 





L_res1 L_res1 | lL —reso L_|IRGNO 
TBI ORGNO 


Figure B2-66 TCR_EL2 bit assignments 


[31] 

Reserved, RESI. 
[30:24] 

Reserved, RESO. 


[23] 
Reserved, RESI. 
[22:21] 
Reserved, RESO. 
TBI, [20] 
Top Byte Ignored. Indicates whether the top byte of the input address is used for address match. 
The possible values are: 
(3 Top byte used in the address calculation. 
1 Top byte ignored in the address calculation. 
[19] 


Reserved, RESO. 
PS, [18:16] 
Physical address size. The possible values are: 
@beee@ 32 bits, 4GB. 
@bee1 36 bits, 64GB. 
@be1e 40 bits, 1TB. 


Other values are reserved. 
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B2 AArch64 system registers 
B2.95 Translation Control Register, EL2 


TGO, [15:14] 
TTBRO_EL2 granule size. The possible values are: 


obðð 4KB. 
@b10 16KB. 
@be1 64KB. 


@b11 Reserved. 


All other values are not supported. 


SHO, [13:12] 
Shareability attribute for memory associated with translation table walks using TTBRO_EL2. 


The possible values are: 


@be@  Non-shareable. 
@be@1 Reserved. 

@b1@ Outer shareable. 
@b11 Inner shareable. 


ORGNDO, [11:10] 
Outer cacheability attribute for memory associated with translation table walks using 
TTBRO_EL2. The possible values are: 
@bee@ Normal memory, Outer Non-cacheable. 
@b@1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b1@ Normal memory, Outer Write-Through Cacheable. 
@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 
IRGNO, [9:8] 
Inner cacheability attribute for memory associated with translation table walks using 
TTBRO_EL2. The possible values are: 
@bee@ Normal memory, Inner Non-cacheable. 
@b@1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
@b1@ Normal memory, Inner Write-Through Cacheable. 
@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
[7:6] 
Reserved, RESO. 


TOSZ, [5:0] 
Size offset of the memory region addressed by TTBRO_EL2. The region size is 241°S7) bytes. 


To access the TCR_EL2: 


MRS <Xt>, TCR_EL2 ; Read EL2 Translation Control Register 
MSR TCR_EL2, <Xt> ; Write EL2 Translation Control Register 


Register access is encoded as follows: 


Table B2-88 TCR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 








11 | 100 |0010 |0000 | 010 
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B2 AArch64 system registers 
B2.96 Translation Control Register, EL3 


B2.96 Translation Control Register, EL3 
The TCR_EL3 characteristics are: 


Purpose 
Controls translation table walks required for stage 1 translation of memory accesses from EL3 
and holds cacheability and shareability information for the accesses. 


TCR_EL3 is part of the Virtual memory control registers functional group. 


Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
: 3 Š = RW RW 


























Configurations 
TCR_EL3 is mapped to AArch32 register TTBR(S). See B/.//3 Translation Table Base 
Register 0 on page B1-333 





Attributes 
TCR_EL3 is a 32-bit register. 
31 30 24 23 22 21 20:19 18 161514131211109 8 7 6 5 0 
L_pRes1 L—res1 | ll reso L_IRGNO 
TBI ORGNO 
Figure B2-67 TCR_EL3 bit assignments 
[31] 


Reserved, RES1. 
[30:24] 
Reserved, RESO. 


[23] 
Reserved, RES1. 
[22:21] 
Reserved, RESO. 
TBI, [20] 
Top Byte Ignored. Indicates whether the top byte of the input address is used for address match. 
The possible values are: 
(3 Top byte used in the address calculation. 
1 Top byte ignored in the address calculation. 
[19] 


Reserved, RESO. 
PS, [18:16] 
Physical address size. The possible values are: 
@beee 32 bits, 4GB. 
@bee1 36 bits, 64GB. 
@be1e 40 bits, 1TB. 


Other values are reserved. 


TGO, [15:14] 
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B2 AArch64 system registers 
B2.96 Translation Control Register, EL3 


TTBRO_EL3 granule size. The possible values are: 


@bee 
@b10 
@be1 
@b11 


4KB. 
16KB. 
64KB. 


Reserved. 


All other values are not supported. 


SHO, [13:12] 


Shareability attribute for memory associated with translation table walks using TTBRO_EL3. 


The possible values are: 


@bee 
@be1 
@b10 
@b11 


Non-shareable. 
Reserved. 
Outer shareable. 


Inner shareable. 


ORGNDO, [11:10] 
Outer cacheability attribute for memory associated with translation table walks using 
TTBRO_EL3. 


The possible values are: 


@bee 
@be1 
@b10 
@b11 


IRGNO, [9:8] 


Normal memory, Outer Non-cacheable. 

Normal memory, Outer Write-Back Write-Allocate Cacheable. 
Normal memory, Outer Write-Through Cacheable. 

Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


Inner cacheability attribute for memory associated with translation table walks using 
TTBRO_EL3. 


The possible values are: 


Normal memory, Inner Non-cacheable. 
Normal memory, Inner Write-Back Write-Allocate Cacheable. 
Normal memory, Inner Write-Through Cacheable. 


Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


Reserved, RESO. 


Q@bee 
Q@be1 
0b10 
0b11 
[7:6] 
TOSZ, [5:0] 


Size offset of the memory region addressed by TTBRO_EL3. The region size is 241°S4) bytes. 
To access the TCR_EL3: 


MRS <Xt>, TCR_EL3 ; Read EL3 Translation Control Register 
MRS TCR_EL3, <Xt> ; Read EL3 Translation Control Register 


Register access is encoded as follows: 


Table B2-89 TCR_EL3 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 110 |0010 |0000 | 010 
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B2 AArch64 system registers 
B2.97 Translation Table Base Register 0, EL1 


B2.97 Translation Table Base Register 0, EL1 
The TTBRO_ ELI characteristics are: 


Purpose 
Holds the base address of translation table 0, and information about the memory it occupies. 
This is one of the translation tables for the stage 1 translation of memory accesses from modes 
other than Hyp mode. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW | RW RW 


























Any of the fields in this register are permitted to be cached in a TLB. 


Configurations 
TTBRO_EL! is architecturally mapped to AArch32 register TTBRO. See B/.//3 Translation 
Table Base Register 0 on page B1-333. 

Attributes 
TTBRO_ELI is 64-bit register. 


63 48 47 0 


ASID BADDR[47:x] 


Figure B2-68 TTBRO_EL1 bit assignments 


ASID, [63:48] 
An ASID for the translation table base address. The TCR_EL1.A1 field selects either 
TTBRO_EL1.ASID or TTBR1_EL1.ASID. 

BADDR[47:x], [47:0] 
Translation table base address, bits[47:x]. Bits [x-1:0] are REso. 


x is based on the value of TCR_EL1.TOSZ, the stage of translation, and the memory translation 
granule size. 


For instructions on how to calculate it, see the ARM" Architecture Reference Manual ARMV8, 
for ARMv8-A architecture profile 


The value of x determines the required alignment of the translation table, that must be aligned to 
2* bytes. 


If bits [x-1:0] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, Where bits [x-1:0] are treated as if all the bits are zero. The value 
read back from those bits is the value written. 


To access the TTBRO ELI: 


MRS <Xt>, TTBR@_EL1 ; Read TTBR@_EL1 into Xt 
MSR TTBR@_EL1, <Xt> ; Write Xt to TTBR@_EL1 


Register access is encoded as follows: 


Table B2-90 TTBRO_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 |0010 | 0000 | 000 
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B2 AArch64 system registers 
B2.98 Translation Table Base Register 1, EL1 


B2.98 Translation Table Base Register 1, EL1 
The TTBR1_EL1 characteristics are: 


Purpose 
Holds the base address of translation table 1, and information about the memory it occupies. 
This is one of the translation tables for the stage 1 translation of memory accesses at ELO and 
ELI. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW | RW RW 


























Any of the fields in this register are permitted to be cached in a TLB. 


Configurations 
TTBR1_EL!1 is architecturally mapped to AArch32 register TTBR1 (NS). See 
B1.116 Translation Table Base Register 1 on page B1-337. 

Attributes 
TTBRI1_ EL] is a 64-bit register. 


63 48.47 0 


ASID BADDR[47:x] 


Figure B2-69 TTBR1_EL1 bit assignments 


ASID, [63:48] 
An ASID for the translation table base address. The TCR_EL1.A1 field selects either 
TTBRO_EL1.ASID or TTBR1_EL1.ASID. 

BADDR[47:x], [47:0] 
Translation table base address, bits[47:x]. Bits [x-1:0] are REso. 


x is based on the value of TCR_EL1.TOSZ, the stage of translation, and the memory translation 
granule size. 


For instructions on how to calculate it, see the ARM® Architecture Reference Manual ARMV8, 
for ARMV8-A architecture profile. 


The value of x determines the required alignment of the translation table, that must be aligned to 
2* bytes. 


If bits [x-1:0] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, Where bits [x-1:0] are treated as if all the bits are zero. The value 
read back from those bits is the value written. 


To access the TTBR1_EL1: 


MRS <Xt>, TTBR1_EL1 ; Read TTBR1_EL1 into Xt 
MSR TTBR1_EL1, <Xt> ; Write Xt to TTBR1_EL1 


Register access is encoded as follows: 


Table B2-91 TTBR1_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0010) 0000 | 001 
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B2 AArch64 system registers 
B2.99 Translation Table Base Register 0, EL3 


B2.99 Translation Table Base Register 0, EL3 
The TTBRO_EL3 characteristics are: 


Purpose 
Holds the base address of the translation table for the stage 1 translation of memory accesses 
from EL3. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
z z 2 7 RW RW 


























Configurations 
TTBRO_EL3 is mapped to AArch32 register TTBRO (S). See B/.//3 Translation Table Base 
Register 0 on page B1-333. 


Attributes 
TTBRO_EL3 is a 64-bit register. 
63 48 47 0 
RESO BADDRI47:x] 
Figure B2-70 TTBRO_EL3 bit assignments 
[63:48] 


Reserved, RESO. 
BADDR[47:x], [47:0] 
Translation table base address, bits[47:x]. Bits [x-1:0] are REso. 


x is based on the value of TCR_EL1.TOSZ, the stage of translation, and the memory translation 
granule size. 


For instructions on how to calculate it, see the ARM® Architecture Reference Manual ARMV8, 
for ARMV8-A architecture profile. 


The value of x determines the required alignment of the translation table, that must be aligned to 
2* bytes. 


If bits [x-1:0] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, Where bits [x-1:0] are treated as if all the bits are zero. The value 
read back from those bits is the value written. 


To access the TTBRO_EL3: 


MRS <Xt>, TTBR@_EL3 ; Read TTBR@_EL3 into Xt 
MSR TTBR@_EL3, <Xt> ; Write Xt to TTBR@_EL3 


Register access is encoded as follows: 


Table B2-92 TTBRO_EL3 access encoding 





op0 | op1 | CRn | CRm | op2 











11 | 110 |0010 |0000 | 000 
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B2 AArch64 system registers 
B2.100 Vector Base Address Register, EL1 


B2.100 Vector Base Address Register, EL1 
The VBAR_ ELI characteristics are: 


Purpose 

Holds the exception base address for any exception that is taken to EL1. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RW [RW [RW [RW RW 


























Configurations 
The VBAR_EL1[31:0] is architecturally mapped to the Non-secure AArch32 VBAR register. 
See B/.119 Vector Base Address Register on page B1-341. 

Attributes 
VBAR ELI is a 64-bit register. 


63 11 10 0 







Vector base address 


Figure B2-71 VBAR_EL1 bit assignments 


Vector base address, [63:11] 

Base address of the exception vectors for exceptions taken in this exception level. 
[10:0] 

Reserved, RESO. 


To access the VBAR_ELI: 


MRS <Xt>, VBAR_EL1 ; Read VBAR_EL1 into Xt 
MSR VBAR_EL1, <Xt> ; Write Xt to VBAR_EL1 


Register access is encoded as follows: 


Table B2-93 VBAR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 1100 | 0000 | 000 
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B2 AArch64 system registers 
B2.101 Vector Base Address Register, EL2 


B2.101 Vector Base Address Register, EL2 
The VBAR_EL2 characteristics are: 


Purpose 

Holds the exception base address for any exception that is taken to EL2. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- J- [RW IRW RW 


























Configurations 
The VBAR_EL2[31:0] is architecturally mapped to the AArch32 HVBAR register. See 
B1.71 Hyp Vector Base Address Register on page B1-254. 

Attributes 
VBAR_EL2 is a 64-bit register. 


63 11 10 0 







Vector base address 


Figure B2-72 VBAR_EL2 bit assignments 


Vector base address, [63:11] 

Base address of the exception vectors for exceptions taken in this exception level. 
[10:0] 

Reserved, RESO. 


To access the VBAR_EL2: 


MRS <Xt>, VBAR_EL2 ; Read VBAR_EL2 into Xt 
MSR VBAR_EL2, <Xt> ; Write Xt to VBAR_EL2 


Register access is encoded as follows: 


Table B2-94 VBAR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 | 1100 | 0000 | 000 
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B2 AArch64 system registers 
B2.102 Vector Base Address Register, EL3 


B2.102 Vector Base Address Register, EL3 
The VBAR_EL3 characteristics are: 


Purpose 

Holds the exception base address for any exception that is taken to EL3. 
Usage constraints 

This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
“fe lee tee RW RW 


























Configurations 
The VBAR_EL3[31:0] is mapped to the Secure AArch32 VBAR register. See B/./19 Vector 
Base Address Register on page B1-341. 

Attributes 
VBAR _EL3 is a 64-bit register. 


63 11 10 0 







Vector base address 


Figure B2-73 VBAR_EL3 bit assignments 


Vector base address, [63:11] 

Base address of the exception vectors for exceptions taken in this exception level. 
[10:0] 

Reserved, RESO. 


To access the VBAR_EL3: 


MRS <Xt>, VBAR_EL3 ; Read EL3 Vector Base Address Register 
MSR VBAR_EL3, <Xt> ; Write EL3 Vector Base Address Register 


Register access is encoded as follows: 


Table B2-95 VBAR_EL3 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 110 | 1100 | 0000 | 000 
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B2 AArch64 system registers 
B2.103 Virtualization Multiprocessor ID Register, EL2 


B2.103 Virtualization Multiprocessor ID Register, EL2 
The VMPIDR_EL2 characteristics are: 


Purpose 
Provides the value of the Virtualization Multiprocessor ID. This is the value returned by Non- 
secure EL! reads of MPIDR. 

Usage constraints 
This register is accessible as follows: 








ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- J- [RW IRW : 


























Configurations 
VMPIDR_EL2[31:0] is architecturally mapped to AArch32 register VMPIDR. See 
B1.120 Virtualization Multiprocessor ID Register on page B1-342. 

Attributes 
VMPIDR_EL2 is a 64-bit register. 


VMPIDR_EL2 resets to the value of MPIDR_EL2. 
63 0 


VMPIDR 


Figure B2-74 VMPIDR_EL2 bit assignments 


VMPIDR, [63:0] 
MPIDR value returned by Non-secure EL1 reads of the MPIDR_EL1. The MPIDR description 
defines the subdivision of this value. See Figure B2-54 MPIDR_EL] bit assignments 
on page B2-494. 


To access the VMPIDR_EL2: 


MRS <Xt>, VMPIDR_EL2 ; Read VMPIDR_EL2 into Xt 
MSR VMPIDR_EL2, <Xt> ; Write Xt to VMPIDR_EL2 


Register access is encoded as follows: 


Table B2-96 VMPIDR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 | 0000 |0000 | 101 
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B2 AArch64 system registers 
B2.104 Virtualization Processor ID Register, EL2 


B2.104 Virtualization Processor ID Register, EL2 
The VPIDR_EL2 characteristics are: 


Purpose 


Holds the value of the Virtualization Processor ID. This is the value returned by Non-secure 


EL1 reads of MIDR_ELI. See Figure B2-53 MIDR_EL] bit assignments on page B2-492. 
Usage constraints 


This register is accessible as follows: 








ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- |. [RW IRW : 


























Configurations 


VPIDR_EL2 is architecturally mapped to AArch32 register VPIDR. See B/./2/ Virtualization 
Processor ID Register on page B1-343. 
Attributes 


VPIDR_EL2 is a 32-bit register. 
VPIDR_EL2 resets to the value of MIDR_ELI1. 
31 0 


VPIDR 


Figure B2-75 VPIDR_EL2 bit assignments 
VPIDR, [31:0] 


MIDR._ EL! value returned by Non-secure EL1 reads of the MIDR_EL1. The MIDR_EL1 


description defines the subdivision of this value. See Figure B2-53 MIDR_EL] bit assignments 
on page B2-492. 


To access the VPIDR_EL2: 


MRS <Xt>, VPIDR_EL2 ; Read VPIDR_EL2 into Xt 
MSR VPIDR_EL2, <Xt> ; Write Xt to VPIDR_EL2 


Register access is encoded as follows: 


Table B2-97 VPIDR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 | 0000 | 0000 | 000 
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B2 AArch64 system registers 
B2.105 Virtualization Translation Control Register, EL2 


B2.105 Virtualization Translation Control Register, EL2 
The VTCR_EL2 characteristics are: 


Purpose 
Controls the translation table walks required for the stage 2 translation of memory accesses from 
Non-secure ELO and EL1, and holds cacheability and shareability information for the accesses. 
Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL14 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- |. [RW IRW RW 


























Any of the bits in VTCR_EL2 are permitted to be cached in a TLB. 


Configurations 
VTCR_EL2 is architecturally mapped to AArch32 register VTCR. See B/./22 Virtualization 
Translation Control Register on page B1-344. 


Attributes 

VTCR_EL2 is a 32-bit register. 

31 30 191817161514131211109 8 7 6 5 
Lres1 ORGNO — 
IRGNO 
Figure B2-76 VTCR_EL2 bit assignments 

[31] 

Reserved, RES1. 
[30:19] 

Reserved, RESO. 
PS, [18:16] 


Physical Address Size. The possible values are: 
@beee 32 bits, 4GB. 

@bee1 36 bits, 64GB. 

@be1e 40 bits, 1TB. 


All other values are reserved. 


TGO, [15:14] 
Granule size for the corresponding VTTBR_EL2. 


ebee)§=—- AK BB. 
@b10 16KB. 
@be1 64KB. 


@b11 Reserved. 


All other values are not supported. 


SHO, [13:12] 
Shareability attribute for memory associated with translation table walks using VTTBR_EL2. 


@bee@ => Non- shareable. 
@b@1 Reserved. 
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@b10 
@b11 


ORGNDO, [11:10] 
Outer cacheability attribute for memory associated with translation table walks using 


B2 AArch64 system registers 
B2.105 Virtualization Translation Control Register, EL2 


Outer Shareable. 
Inner Shareable. 


VTTBR_EL2. 

@bee@ Normal memory, Outer Non-cacheable. 

@b@1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b1@ Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


IRGNO, [9:8] 


Inner cacheability attribute for memory associated with translation table walks using 


VTTBR_EL2. 

@bee@ Normal memory, Inner Non-cacheable. 

@be@1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 

@b1@ Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
SLO, [7:6] 


Starting level of the VTCR_EL2 addressed region. 


TOSZ, [5:0] 


The size offset of the memory region addressed by VTTBR_EL2. The region size is 2(64-T0S2) 


bytes. 


To access the VTCR_EL2: 


MRS <Xt>, VTCR_EL2 ; Read VTCR_EL2 into Xt 
MSR VTCR_EL2, <Xt> ; Write Xt to VTCR_EL2 


Register access is encoded as follows: 


Table B2-98 VTCR_EL2 access encoding 
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Chapter B3 
GIC registers 


This chapter describes the GIC registers. 


It contains the following sections: 

¢ B3.1 CPU interface register summary on page B3-534. 

e B3.2 Active Priority Register on page B3-535. 

e B3.3 CPU Interface Identification Register on page B3-536. 

¢ 83.4 Virtual interface control register summary on page B3-537. 
e B3.5 VGIC Type Register on page B3-538. 

¢ 83.6 Virtual CPU interface register summary on page B3-539. 

¢ B3.7VM Active Priority Register on page B3-540. 

¢ B3.8 VM CPU Interface Identification Register on page B3-541. 
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B3.1 


CPU interface register summary 


B3 GIC registers 
B3.1 CPU interface register summary 


Each CPU interface block provides the interface for a Cortex-A35 processor that interfaces with a GIC 
distributor within the system. 


Each CPU interface provides a programming interface for: 


¢ Enabling the signaling of interrupt requests by the CPU interface. 
e Acknowledging an interrupt. 
e Indicating completion of the processing of an interrupt. 

e Setting an interrupt priority mask for the processor. 

¢ Defining the preemption policy for the processor. 

e Determining the highest priority pending interrupt for the processor. 
e Generating SGIs. 


For more information on the CPU interface, see the ARM® Generic Interrupt Controller Architecture 


Specification. 


The following table lists the registers for the CPU interface. 


All the registers in the following table are word-accessible. Registers not described in this table are REso. 
See the ARM” Generic Interrupt Controller Architecture Specification for more information. 


Table B3-1 CPU interface register summary 






























































Offset | Name Type | Reset Description 
0x0000 | GICC_CTLR RW |@0x00000000 CPU Interface Control Register 
0x0004 | GICC_PMR RW |@0x00000000 Interrupt Priority Mask Register 
0x0008 | GICC_BPR RW |@0x00000002 (Secure) Binary Point Register 
0x00000003 (Non-secure) 
@x@@@C | GICC_IAR RO | - Interrupt Acknowledge Register 
0x0010 | GICC_EOIR WO |- End Of Interrupt Register 
090x0014 | GICC_RPR RO |@0x00000OFF Running Priority Register 
0x0018 | GICC_HPPIR |RO |@0x000003FF Highest Priority Pending Interrupt Register 
@x@@1C | GICC_ABPR RW |0x00000003 Aliased Binary Point Register 
x00290 | GICC_AIAR RO |- Aliased Interrupt Acknowledge Register 
0x0024 | GICC_AEOIR |WO |- Aliased End of Interrupt Register 
0x0028 | GICC_AHPPIR | RO |@0x000003FF Aliased Highest Priority Pending Interrupt Register 
@x@@DO | GICC_APRO RW |@0x00000000 B3.2 Active Priority Register on page B3-535 
OxX00EO | GICC_NSAPRO | RW | 0x00000000 Non-secure Active Priority Register 
@x@@FC | GICC_IIDR RO | 0x0044243B B3.3 CPU Interface Identification Register on page B3-536 
Qx1000 | GICC_DIR WO |- Deactivate Interrupt Register 
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B3 GIC registers 
B3.2 Active Priority Register 


B3.2 Active Priority Register 


The GICC_APRO characteristics are: 


Purpose 
Provides support for preserving and restoring state in power management applications. 
Usage constraints 
This register is banked to provide Secure and Non-secure copies. This ensures that Non-secure 
accesses do not interfere with Secure operation. 
Configurations 
Available in all configurations. 
Attributes 
See the register summary in B3./ CPU interface register summary on page B3-534. 


The Cortex-A35 processor implements the GICC_APRO according to the recommendations described in 
the ARM Generic Interrupt Controller Architecture Specification. 


Table B3-2 Active Priority Register implementation 
































Number of Preemption Minimum value | Minimum legal Active Priority View of Active Priority 
group levels of Secure value of Non- Registers Registers for Non-secure 
priority bits GICC_BPR secure implemented accesses 
GICC_BPR 

5 32 2 3 GICC_APRO [31:0] | GICC_NSAPRO [31:16] 

appears as GICC_APRo 

[15:0] 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights B3-535 
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B3 GIC registers 
B3.3 CPU Interface Identification Register 


B3.3 CPU Interface Identification Register 
The GICC_IIDR characteristics are: 


Purpose 
Provides information about the implementer and revision of the CPU interface. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See the register summary in B3./ CPU interface register summary on page B3-534. 


31 20 19 16 15 12 11 0 


ProductID prenite Ge Implementer 
version 


Figure B3-1 GICC_IIDR bit assignments 


ProductID, [31:20] 
Identifies the product: 


0x004 Cortex-A35 processor. 


Architecture version, [19:16] 
Identifies the architecture version of the GIC CPU interface: 


0x4 GICv4. 


Revision, [15:12] 
Identifies the revision number for the CPU interface: 
0x2 r0p2. 
Implementer, [11:0] 
Contains the JEP 106 code of the company that implements the CPU interface: 


0x43B ARM. 
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Virtual interface control register summary 


B3 GIC registers 


B3.4 Virtual interface control register summary 


The virtual interface control registers are management registers. Configuration software on the 
Cortex-A35 processor must ensure they are accessible only by a hypervisor, or similar software. 


The following table describes the registers for the virtual interface control registers. All these registers 
are word-accessible. Registers not described in this table are Reso. See the ARM® Generic Interrupt 
Controller Architecture Specification for more information. 


Table B3-3 Virtual interface control register summary 















































Offset | Name Type | Reset Description 

0x000 | GICH_HCR RW | 0x@000008O | Hypervisor Control Register 

0x004 | GICH_VTR RO | 0x90000@@3 | B3.5 VGIC Type Register on page B3-538 
0x008 | GICH VMCR |RW_ |@0x004C0000 | Virtual Machine Control Register 
0x010 | GICH_MISR RO _ | @x@0000088 | Maintenance Interrupt Status Register 
0x020 | GICH_EISRO IRO | 0x@0000000 | End of Interrupt Status Registers 
0x030 | GICH_ELRSRO|RO_ |0x0000000F | Empty List Register Status Registers 
@x@F@ | GICH_APRO RW |@0x00000000 | Active Priorities Register 

0x100 | GICH_LRO RW | 0x00008020 | List Register 0 

0x104 | GICH_LR1 RW | 0x00000020 | List Register 1 

@x108 | GICH_LR2 RW _| 0x000000@0 | List Register 2 

@x10C | GICH_LR3 RW | 0x00000020 | List Register 3 
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VGIC Type Register 


The GICH_VTR characteristics are: 


Purpose 
Holds information on number of priority bits, number of preemption bits, and number of List 
Registers implemented. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See the register summary in B3.4 Virtual interface control register summary on page B3-537. 


31 2928 2625 6 5 0 


Figure B3-2 GICH_VTR bit assignments 


PRIbits, [31:29] 
Indicates the number of priority bits implemented, minus one: 


0x4 Five bits of priority and 32 priority levels. 


PREbits, [28:26] 
Indicates the number of preemption bits implemented, minus one: 
0x4 Five bits of preemption and 32 preemption levels. 
[25:6] 
Reserved, RESO. 
ListRegs, [5:0] 
Indicates the number of implemented List Registers, minus one: 


0x3 Four List Registers. 
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B3 GIC registers 
B3.6 Virtual CPU interface register summary 


Virtual CPU interface register summary 


The virtual CPU interface forwards virtual interrupts to a connected Cortex-A35 processor, subject to the 


normal GIC handling and prioritization rules. 


The virtual interface control registers control virtual CPU interface operations. In particular, the virtual 
CPU interface uses the contents of the List registers to determine when to signal virtual interrupts. When 
a core accesses the virtual CPU interface, the List registers are updated. For more information on the 
virtual CPU interface, see the ARM® Generic Interrupt Controller Architecture Specification. 


The following table describes the registers for the virtual CPU interface. 


All the registers in the following table are word-accessible. Registers not described in this table are REso. 
See the ARM® Generic Interrupt Controller Architecture Specification for more information. 


Table B3-4 Virtual CPU interface register summary 





















































Name Type | Reset Description 

GICV_CTLR |RW_ | 0x@000008@ | VM Control Register 

GICV_PMR RW | 0x@0008880 | VM Priority Mask Register 

GICV_BPR RW | 0x@0000002 | VM Binary Point Register 

GICV_IAR RO |- VM Interrupt Acknowledge Register 

GICV_EOIR WO |- VM End Of Interrupt Register 

GICV_RPR RO |@0x000000FF | VM Running Priority Register 

GICV_HPPIR |RO_ | @x@00003FF | VM Highest Priority Pending Interrupt Register 
GICV_ABPR |RW_ | 0x@00000@3 | VM Aliased Binary Point Register 

GICV_AIAR RO |J- VM Aliased Interrupt Acknowledge Register 
GICV_AEOIR | WO |- VM Aliased End of Interrupt Register 
GICV_AHPPIR|RO_ | @x@0@@@3FF | VM Aliased Highest Priority Pending Interrupt Register 
GICV_APRO RW |@0x00000000 | B3.7 VM Active Priority Register on page B3-540 
GICV_TIDR RO | 0x00442438B | B3.8 VM CPU Interface Identification Register on page B3-541 
GICV_DIR WO |- VM Deactivate Interrupt Register 
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B3.7 VM Active Priority Register 


B3.7 VM Active Priority Register 
GICV_APRO 


For software compatibility, this register is present in the virtual CPU interface. However, in a virtualized 
system, it is not used when preserving and restoring state. 


The GICV_APRO characteristics are: 


Purpose 
For software compatibility, this register is present in the virtual CPU interface. However, in a 
virtualized system, it is not used when preserving and restoring state. 
Usage constraints 
Reading the content of this register and then writing the same values must not change any state 
because there is no requirement to preserve and restore state during a powerdown. 
Configurations 
Available in all configurations. 
Attributes 
See the register summary in B3.6 Virtual CPU interface register summary on page B3-539. 


The Cortex-A35 processor implements the GICV_APRO as an alias of GICH_APRO. 
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B3.8 VM CPU Interface Identification Register 
The GICV_IIDR characteristics are: 


Purpose 
Provides information about the implementer and revision of the virtual CPU interface. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See the register summary in B3.6 Virtual CPU interface register summary on page B3-539. 
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Figure B3-3 GICV_IIDR bit assignments 


ProductID, [31:20] 
Identifies the product: 


0x004 Cortex-A35 processor. 


Architecture version, [19:16] 
Identifies the architecture version of the GIC CPU Interface: 


0x4 GICv4. 


Revision, [15:12] 
Identifies the revision number for the CPU interface: 
0x2 r0p2. 
Implementer, [11:0] 
Contains the JEP 106 code of the company that implements the CPU interface: 


0x43B ARM. 
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B3.8 VM CPU Interface Identification Register 
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Chapter B4 
Generic Timer registers 


This chapter describes the Generic Timer registers. 


It contains the following sections: 

e B4.1 Generic Timer register summary on page B4-544. 

¢ B4.2 AArch32 Generic Timer register summary on page B4-545. 
¢ B4.3 AArch64 Generic Timer register summary on page B4-546. 
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B4 Generic Timer registers 
B4.1 Generic Timer register summary 


B4.1 Generic Timer register summary 
A set of Generic Timer registers are allocated within each core. 


The Generic Timer registers are either 32-bits wide or 64-bits wide and accessible in the AArch32 and 
AArch64 Execution states. 
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B4.2 AArch32 Generic Timer register summary 


B4.2 AArch32 Generic Timer register summary 
The following table shows the AArch32 Generic Timer registers. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for information 
about these registers. 


Table B4-1 AArch32 Generic Timer registers 














Name CRn | Op1 | CRm | Op2 | Reset | Width | Description 

CNTFRQ cl4 |0 c0 0 UNK | 32-bit | Counter-timer Frequency register 
CNTPCT - 0 cl4 J- UNK |64-bit | Counter-timer Physical Count register 
CNTKCTL cl4 |0 cl 0 - 32-bit | Counter-timer Kernel Control register 


The reset value for bits[9:8, 2:0] is @b800@0. 





CNTP_TVAL c2 0 UNK | 32-bit | Counter-timer Physical Timer TimerValue register 








CNTP_CTL 1 - 32-bit | Counter-timer Physical Timer Control register 


The reset value for bit[0] is 0. 





CNTV_TVAL c3 0 UNK |32-bit | Counter-timer Virtual Timer TimerValue register 








CNTV_CTL 1 32-bit | Counter-timer Virtual Timer Control register 


The reset value for bit[0] is 0. 























CNTVCT - 1 cl4 |- UNK | 64-bit | Counter-timer Virtual Count register 

CNTP_CVAL 2 UNK | 64-bit | Counter-timer Physical Timer CompareValue register 
CNTV_CVAL 3 UNK | 64-bit | Counter-timer Virtual Timer Compare Value register 
CNTVOFF 4 UNK | 64-bit | Counter-timer Virtual Offset register 

CNTHCTL cl4 |4 cl 0 - 32-bit | Counter-timer Hyp Control register 


The reset value for bit[2] is 0 and for bits[1:0] is @b11. 





CNTHP_TVAL c2 0 UNK | 32-bit | Counter-timer Hyp Physical Timer TimerValue register 





CNTHP_CTL 1 32-bit | Counter-timer Hyp Physical Timer Control register 


The reset value for bit[0] is 0. 









































CNTHP_CVAL |- 6 cl4 J- UNK |64-bit | Counter-timer Hyp Physical CompareValue register 
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B4 Generic Timer registers 
B4.3 AArch64 Generic Timer register summary 













































































B4.3 AArch64 Generic Timer register summary 
The following table shows the AArch64 Generic Timer registers. 
See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for information 
about these registers. 
Table B4-2 AArch64 Generic Timer registers 
Name Op0 | CRn | Op1 | CRm | Op2 | Reset | Width | Description 
CNTKCTL_EL1 3 cl4 |0 cl 0 - 32-bit | Counter-timer Kernel Control register 
The reset value for bits[9:8, 2:0] is @b00080. 
CNTFRQ_ ELO 3 c0 0 UNK | 32-bit | Counter-timer Frequency register 
CNTPCT_ELO 1 UNK | 64-bit | Counter-timer Physical Count register 
CNTVCT_ELO 2 UNK | 64-bit | Counter-timer Virtual Count register 
CNTP_TVAL_ ELO c2 0 UNK | 32-bit | Counter-timer Physical Timer TimerValue register 
CNTP_CTL_ELO 1 - 32-bit | Counter-timer Physical Timer Control register 
The reset value for bit[0] is 0. 
CNTP_CVAL ELO 2 UNK |64-bit | Counter-timer Physical Timer CompareValue register 
CNTV_TVAL_EL0 c3 0 UNK | 32-bit | Counter-timer Virtual Timer TimerValue register 
CNTV_CTL_ELO 1 32-bit | Counter-timer Virtual Timer Control register 
The reset value for bit[0] is 0. 
CNTV_CVAL _ELO 2 UNK | 64-bit | Counter-timer Virtual Timer CompareValue register 
CNTVOFF_EL2 4 c0 3 UNK | 64-bit | Counter-timer Virtual Offset register 
CNTHCTL_EL2 cl 0 - 32-bit | Counter-timer Hypervisor Control register 
The reset value for bit[2] is 0 and for bits[1:0] is @b11. 
CNTHP_TVAL EL2 c2 0 UNK | 32-bit | Counter-timer Hypervisor Physical Timer TimerValue 
register 
CNTHP_CTL_EL2 1 32-bit | Counter-timer Hypervisor Physical Timer Control register 
The reset value for bit[0] is 0. 
CNTHP_CVAL EL2 2 UNK | 64-bit | Counter-timer Hypervisor Physical Timer Compare Value 
register 
CNTPS_TVAL EL1 7 c2 0 UNK | 32-bit | Counter-timer Physical Secure Timer TimerValue register 
CNTPS_CTL_EL1 1 - 32-bit | Counter-timer Physical Secure Timer Control register 
The reset value for bit[0] is 0. 
CNTPS_CVAL EL1 2 UNK | 64-bit | Counter-timer Physical Secure Timer Compare Value 
register 
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Part C 
Debug 


Chapter C1 
Debug 


This chapter describes the debug features of the processor. 


It contains the following sections: 

e C1.l About debug methods on page C1-550. 

e C1.2 Debug access on page C1-551. 

e C1.3 Effects of resets on debug registers on page C1-552. 

e C1.4 External access permissions to debug registers on page C1-553. 
e C1.5 Debug events on page C1-554. 

e C1.6 Debug memory map on page C1-555. 

e C1.7 Debug signals on page C1-557. 

e C1.8 Changing the authentication signals for debug on page C1-558. 
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C1 Debug 
C1.1 About debug methods 


C1.1 About debug methods 


The processor is part of a debug system and supports both self-hosted and external debug. 


The following figure shows a typical external debug system. 
































Debug host [Protocol Debug target 
converter 
>| Processor 
¢——— — 
Debug 
unit 























Figure C1-1 External debug system 


Debug host 
A computer, for example a personal computer, that is running a software debugger such as the 
DS-5 Debugger. With the debug host, you can issue high-level commands, such as setting a 
breakpoint at a certain location or examining the contents of a memory address. 
Protocol converter 
The debug host sends messages to the debug target using an interface such as Ethernet. 
However, the debug target typically implements a different interface protocol. A device such as 
DSTREAM is required to convert between the two protocols. 
Debug target 
The lowest level of the system implements system support for the protocol converter to access 
the debug unit using the Advanced Peripheral Bus (APB) slave interface. An example of a 
debug target is a development system with a test chip or a silicon part with a processor. 
Debug unit 
Helps debugging software that is running on the processor: 
e Hardware systems that are based on the processor. 
e Operating systems. 
e Application software. 


With the debug unit, you can: 

e Stop program execution. 

e Examine and alter process and coprocessor state. 

¢ Examine and alter memory and the state of the input or output peripherals. 
e Restart the processor. 


For self-hosted debug, the debug target runs additional debug monitor software that runs on the 
Cortex-A35 processor itself. This way, it does not require expensive interface hardware to connect a 
second host computer. 


Related information 
C1.2 Debug access on page C1-551. 
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C1 Debug 
C1.2 Debug access 


C1.2 Debug access 


The processor implements the ARMv8 Debug architecture and debug events. Accessing system registers 
allows the processor to access certain debug registers directly. The external debug interface enables both 
external and self-hosted debug agents to access debug registers. 


The partitioning of debug register access is as follows: 


Debug registers 
Access is based on the system registers and is memory-mapped. You can access the debug 
register map using the APB slave port. 





























PMU 
Access is based on the system registers and is memory-mapped. You can access the performance 
monitor registers using the APB slave port. 
ETM 
Access is memory-mapped. 
CTI 
Access is based on the debug registers and is memory-mapped. 
Processor 
DBGEN }¢—_PCLKENDBG—— 
a > le—PSELDBG 
Authentication SPIDEN———> |4 PADDRDBG31— 
interface —_NIDEN—_>> 
SPNIDEN ¢——PADDRDBG——— 
-———PRDATADBG—> Debug slave 
<+—_—_COMMTX: ¢—PWDATADBG——= port, APBv3 
DCG { som ¢—PENABLEDBG—— 
handshake 
+— nCOMMIRQ——_ t——PREADYDBG—_»> 
I——PSLVERRDBG—»> 
Debug state pa ¢—_PWRITEDBG——__ 
entry EDBGRQ——> 
Power —DBGPWRDUP—» 
controller <—DBGPWRUPREQ— [+ DBGROMADDR=— Configuration 
interface |__ +-DBGNOPWRDWN—| A 3 
Rave ieee eadcaed 
interface +—DBGRSTREQ—— 











Figure C1-2 External debug interface 


Related information 
Chapter C4 CTI on page C4-577. 
Appendix A Signal Descriptions on page Appx-A-8 11. 
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C1 Debug 
C1.3 Effects of resets on debug registers 


Effects of resets on debug registers 


Some of the processor reset signals affect the debug registers. 


nCPUPORESET 
Cold reset that covers reset of the processor logic and the integrated debug functionality. 


The signal initializes the processor logic, including the debug, Embedded Trace Macrocell 
(ETM) trace unit, breakpoint, watchpoint logic, and performance monitors logic. 


nCORERESET 
Warm reset that covers reset of the processor logic. 


The signal resets some of the debug and performance monitor logic. 


nPRESETDBG 
External debug reset that covers the resetting of the external debug interface and has no impact 
on the processor functionality. 


The signal initializes the shared debug APB, Cross Trigger Interface (CTI), and Cross Trigger 
Matrix (CTM) logic. 


Related information 
A3.3 Resets on page A3-50. 
Appendix A Signal Descriptions on page Appx-A-8 11. 
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C1 Debug 
C1.4 External access permissions to debug registers 























C1.4 External access permissions to debug registers 
External access permission to the debug registers is subject to the conditions at the time of the access. 
The following table describes the processor response to accesses to the debug registers. 
Table C1-1 Conditions on external register access to debug registers 
Name | Condition Description 
Off EDPRSR.PU is 0 The processor power domain is completely off or in a low-power state in 
which the processor power domain registers cannot be accessed. 
If debug power is off, then all external debug and memory-mapped register 
accesses return an error. 
DLK | EDPRSR.DLK is 1 OS Double Lock is locked. 
OSLK | OSLSR_ELI1.OSLK is 1 OS Lock is locked. 
EDAD | AllowExternalDebugAccess() == External debug access is disabled. When an error is returned because of an 
FALSE EDAD condition code, the highest priority error condition, 
EDPRSR.SDAD is set to 1. Otherwise SDAD is unchanged. 
SLK Memory-mapped interface only Software lock is locked. For the external debug interface, ignore this 
column. 
Default | - None of the conditions apply, normal access. 

















The following table shows an example of external register condition codes for access to a debug register. 
To determine the access permission for the register, scan the columns from left to right. Stop at the first 
column a condition is true, the entry gives the access permission of the register and scanning stops. 


Table C1-2 Code example for the conditions on external register access to debug registers 





Off | DLK | OSLK | EDAD | SLK | Default 





- - - - RO/WI | RO 
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C1 Debug 
C1.5 Debug events 


C1.5 Debug events 


A debug event can be either a software debug event or a halting debug event. A core responds to a debug 
event in one of the following ways: ignores it, takes a debug exception, or enters debug state. 


In the processor, watchpoint debug events are always synchronous. Memory hint instructions and cache 
clean operations, except DC ZVA, DC IVAC, and DCIMVAC, do not generate watchpoint debug events. 
Store exclusive instructions generate a watchpoint debug event even when the check for the control of 
exclusive monitor fails. For watchpoint debug events, except those resulting from cache maintenance 
operations, the value reported in DFAR is guaranteed to be no lower than the address of the watchpointed 
location rounded down to a multiple of 16 bytes. 


The powerup reset signal, nCPUPORESET, sets the Debug OS Lock. For the debug events and debug 
register accesses to operate normally, the Debug OS Lock must be cleared. 


Related information 

A3.3 Resets on page A3-50. 

A.4 Reset signals on page Appx-A-815. 

ARM® Architecture Reference Manual ARMVv8, for ARMvs-A architecture profile. 
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Debug memory map 


C1 Debug 
C1.6 Debug memory map 


The basic memory map supports up to four cores in the cluster. You can configure the mapping as a v8 or 
as av7 Debug memory map. 


The following table shows the address mapping for the debug APB components when you configure 
them for a v8 Debug memory map. Each component in the table requires 4KB and uses the bottom 4KB 
of each 64KB region. The remaining 60KB of each region is reserved. The table indicates the mapped 
component if it is present, otherwise the field is reserved. 


Table C1-3 Address mapping for APB components in a v8 Debug memory map 





Address offset [21:0] 


Mapped to 





0x800000 - OxOBOFFF 


APB ROM table for the processor 





0x010000 - OxO1OFFF 


Core 0 Debug 





0x020000 - OxO2OFFF 


Core 0 CTI 





0x030000 - OxO30FFF 


Core 0 PMU 





0x040000 - OxO4OFFF 


Core 0 Trace 





0x041000 - Ox1OFFFF 


Reserved 





0x110000 - @x110FFF 


Core 1 Debug 





0x120000 - @x120FFF 


Core 1 CTI 





0x130000 - @x130FFF 


Core 1 PMU 





0x140000 - @x14@FFF 


Core 1 Trace 





0x141000 - 0x20FFFF 


Reserved 





0x210000 - @x210FFF 


Core 2 Debug 





0x220000 - 0x220FFF 


Core 2 CTI 





0x230000 - Ox230FFF 


Core 2 PMU 





0x240000 - Ox24@FFF 


Core 2 Trace 





0x241000 - Ox3OFFFF 


Reserved 





0x310000 - @x310FFF 


Core 3 Debug 





0x320000 - Ox320FFF 


Core 3 CTI 





0x330000 - @x330FFF 


Core 3 PMU 





0x340000 - Ox340FFF 


Core 3 Trace 








0x341000 - Ox3FFFFF 





Reserved 








The following table shows the address mapping for the debug components when you configure them for 
a v7 Debug memory map. The table indicates the mapped component if it is present, otherwise the field 


is reserved. 
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C1 Debug 
C1.6 Debug memory map 


Table C1-4 Address mapping for APB components in a v7 Debug memory map 





Address offset [21:0] 


Mapped to 





Qx00000 - OxOOFFF 


APB ROM table for the processor 





0x01000 - OxO7FFF 


Reserved for other debug components 





0x08000 - OXOFFFF 


Reserved for future expansion 





Qx10000 - Ox1OFFF 


Core 0 Debug 





Qx11000 - @x11FFF 


Core 0 PMU 





0x12000 - @x12FFF 


Core 1 Debug 











Qx13000 - Ox13FFF Core 1 PMU 
0x14000 - Ox14FFF Core 2 Debug 
0x15000 - Ox15FFF Core 2 PMU 





Qx16000 - @x16FFF 


Core 3 Debug 























0x17000 - @x17FFF Core 3 PMU 
0x18000 - @x18FFF Core 0 CTI 
Qx19000 - @x19FFF Core 1 CTI 
Qx1A000 - Ox1AFFF Core 2 CTI 
Qx1B000 - @x1BFFF Core 3 CTI 





Qx1C0@O - Ox1CFFF 


Core 0 Trace 





0x1D000 - @x1DFFF 


Core | Trace 





0x1E000 - Ox1EFFF 


Core 2 Trace 








0x1F000 - Ox1FFFF 





Core 3 Trace 
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C1.7 Debug signals 


C1.7 Debug signals 
The DBGPWRDUP and DBGL1IRSTDISABLE signals are subject to particular rules. 


You must set the DBGPWRDUP signal LOW before removing power to the processor domain. After 
power is restored to the processor domain, the DBGPWRDUP signal must be asserted HIGH. The 
EDPRSR.PU bit reflects the value of this DBGPWRDUP signal. DBGPWRDUP must be tied HIGH if 
the particular implementation does not support separate processor and SCU power domains. 


When you set it HIGH, the DBGLIRSTDISABLE input signal disables the automatic, hardware- 
controlled invalidation with nCORERESET or nCPUPORESET of the L1 data cache after the 
processor is reset. You must use DBGLIRSTDISABLE only to debug a reset that an external watchdog 
triggered. This signal makes the contents of the L1 data cache from before the reset observable after the 
reset. If reset is asserted while an L1 data cache eviction or L1 data cache fetch is performed, the 
accuracy of those cache entries is not guaranteed. You must not use the DBGLIRSTDISABLE signal to 
disable the automatic, hardware controlled invalidation of the L1 data cache in normal processor 
powerup sequences. This is because there is no guarantee that the L1 data cache invalidation sequence is 
synchronized to the duplicate L1 tags in the SCU. The DBGLIRSTDISABLE signal applies to all cores 
in the cluster. Each core samples the signal when nCORERESET or nCPUPORESET is asserted. If the 
functionality offered by the DBGLIRSTDISABLE input signal is not required, the input must be tied to 
LOW. 


Related information 
A.14 Debug signals on page Appx-A-8335. 
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C1.8 Changing the authentication signals for debug 


C1.8 Changing the authentication signals for debug 


The NIDEN, DBGEN, SPIDEN, and SPNIDEN input signals are either tied off to some fixed value or 
controlled by some external device. If software running on the processor has control over an external 
device that drives the authentication signals, it must change the signal value using the specified 
procedure. 


Procedure 

1. Execute an implementation-specific sequence of instructions to change the signal value. For example, 
a single STR instruction might write certain values to a control register in a system peripheral. 

2. If step / on page C1-558 involves any memory operation, issue a DSB instruction. 

3. Issue an ISB instruction or exception entry or exception return. 


4. Poll the DBGAUTHSTATUS ELI register to check whether the processor has already detected the 
changed value of these signals. This check is required because the system might not issue the signal 
change to the processor until several cycles after the DSB instruction completes. 


Postrequisites 


Software cannot perform debug or analysis operations that depend on the new value of the authentication 
signals until this procedure is complete. The same rules apply when the debugger has control of the 
processor through the Instruction Transfer Register, EDITR, while in debug state. You can determine the 
relevant combinations of the DBGEN, NIDEN, SPIDEN, and SPNIDEN values by polling 
DBGAUTHSTATUS ELI. 


Related information 
A.14 Debug signals on page Appx-A-835. 
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Chapter C2 
PMU 


This chapter describes the Performance Monitor Unit (PMU) of the processor. 


It contains the following sections: 

e (2.1 About the PMU on page C2-560. 

e (2.2 External register access permissions to the PMU registers on page C2-561. 
e (2.3 Performance monitoring events on page C2-562. 

e C2.4 PMU interrupts on page C2-566. 

e (2.5 Exporting PMU events on page C2-567. 
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C2 PMU 
C2.1 About the PMU 


C2.1 About the PMU 


The processor includes performance monitors that enable you to gather various statistics on the operation 
of the processor and its memory system during runtime. They provide useful information that you can 
use when debugging or profiling code. 


The PMU provides six counters. Each counter can count any of the events available in the processor. The 
absolute counts that the PMU records might vary because of pipeline effects. This variability only has an 
impact on the operation of the PMU when a counter is enabled for a short time. 





Core 
PMU control 
registers 





Configuration 





PMU 


CLKIN >! Cycle 
counter 1 : 
m Interrupt and nPMUIRQ—>- 
overflow registers 
Performance 
Other | Events 
components counters 






























































Figure C2-1 PMU block diagram 


Event interface 
Events from all other units from across the design are provided to the PMU. 
System register and APB interface 
You can program the PMU registers using the system registers or external APB interface. 
Counters 
The PMU has six 32-bit performance counters and one 64-bit cycle counter. The performance 
counters increment when they are enabled based on events. 
PMU register interfaces 
The processor supports access to the performance monitor registers from the internal system 
register interface or external debug interface. 


Related information 
C2.3 Performance monitoring events on page C2-562. 
C4.2 Cross-trigger inputs and outputs on page C4-579. 
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C2.2 External register access permissions to the PMU registers 


C2 PMU 


C2.2 External register access permissions to the PMU registers 


External access permission to the PMU registers is subject to conditions at the time of the access. 


The following table describes the processor response to accesses through the external debug interface. 


Table C2-1 Conditions on external register access to PMU 





Name_| Condition 


Description 





Off EDPRSR.PU is 0 


Processor power domain is completely off or in a low-power state where the 
processor power domain registers cannot be accessed. 





DLK EDPRSR.DLK is 1 


OS Double Lock is locked. 





OSLK | OSLSR_EL1.OSLK is 1 


OS Lock is locked. 





EPMAD | AllowExternalPMUAccess() == FALSE | External performance monitors access is disabled. When an error is returned 
because of an EPMAD condition code, and it is the highest priority error 
condition, EDPRSR.SPMAD is set to 1. Otherwise SPMAD is unchanged. 





SLK Memory-mapped interface only 


Software lock is locked. For the external debug interface, ignore this column. 





Default 











None of the conditions apply, normal access. 








To determine the access permission for the register, scan the columns from left to right in the register 
usage constraints table. An example is shown in Table C2-2 Example for external register condition 
code on page C2-561 . Stop at the first column in which the condition is true. The entry gives the 

register access permission and scanning stops. 


Table C2-2 Example for external register condition code 
































Off | DLK | OSLK | EPMAD | SLK __| Default 
- - - - RO/WI | RO 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights C2-561 


reserved. 
Non-Confidential 


C2 PMU 
C2.3 Performance monitoring events 
















































































C2.3 Performance monitoring events 
The PMU monitors events in the processor and uses reference numbers for significant ones. 
The following table shows the bit position of each event on the event bus. Event reference numbers that 
are not listed are reserved. 
Table C2-3 Performance monitoring events 
Number | Event mnemonic PMU event PMU Event name 
bus to event bus 
external to trace 
0x00 SW_INCR - - Software increment. The register is incremented only 
on writes to the Software Increment Register. 
0x01 L1I CACHE _ REFILL [0] [0] L1 Instruction cache refill. 
0x02 L1I TLB_REFILL [1] [1] L1 Instruction TLB refill. 
0x03 L1D_CACHE_REFILL [2] [2] L1 Data cache refill. 
0x04 L1D_CACHE [3] [3] L1 Data cache access. 
0x05 L1D_TLB_REFILL [4] [4] L1 Data TLB refill. 
0x06 LD_RETIRED [5] [5] Instruction that is architecturally executed, condition 
check pass - load. 
0x07 ST_RETIRED [6] [6] Instruction that is architecturally executed, condition 
check pass - store. 
0x08 INST_RETIRED [7] [7] Instruction that is architecturally executed. 
- - [8] [8] Two instructions are architecturally executed. 
Counts every cycle in which two instructions are 
architecturally retired. Event 0x08, INST_RETIRED, 
always counts when this event counts. 
0x09 EXC_ TAKEN [9] [9] Exception taken. 
Ox@A EXC_RETURN [10] [10] Exception return. 
@x@B CID_WRITE_RETIRED [11] [11] Change to Context ID retired. 
@xOC PC_WRITE_RETIRED [12] [12] Instruction that is architecturally executed, condition 
check pass, software change of the PC. 
@xe@D BR_IMMED_ RETIRED [13] [13] Instruction that is architecturally executed, immediate 
branch. 
@x@E BR_RETURN_RETIRED - - Instruction that is architecturally executed, condition 
code check pass, procedure return. 
OxO@F UNALIGNED_ LDST_RETIRED | [14] [14] Instruction that is architecturally executed, condition 
check pass, unaligned load or store. 
0x10 BR_MIS_ PRED [15] [15] Mispredicted or not predicted branch that is 
speculatively executed. 
0x11 CPU_CYCLES - - Cycle. 
0x12 BR_PRED [16] [16] Predictable branch that is speculatively executed. 
0x13 MEM_ACCESS [17] [17] Data memory access. 
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C2 PMU 
C2.3 Performance monitoring events 


Table C2-3 Performance monitoring events (continued) 

















































































































Number | Event mnemonic PMU event PMU Event name 
bus to event bus 
external to trace 

0x14 L1I CACHE [18] [18] L1 Instruction cache access. 

0x15 LID CACHE_WB [19] [19] L1 Data cache writeback. 

0x16 L2D_CACHE [20] [20] L2 Data cache access. 

0x17 L2D_CACHE_REFILL [21] [21] L2 Data cache refill. 

0x18 L2D_CACHE_WB [22] [22] L2 Data cache write-back. 

0x19 BUS_ACCESS - - Bus access. 

@x1A MEMORY ERROR - - Local memory error. 

@x1B INST_SPEC - - Operation speculatively executed. 

@x1D BUS_CYCLES - - Bus cycle. 

@x1E CHAIN - - Odd performance counter chain mode. 

0x60 BUS_ACCESS_LD - - Bus access - Read. 

0x61 BUS_ACCESS_ST - - Bus access - Write. 

0x73 DP_SPEC - - Operation speculatively executed, integer data- 
processing. 

0x74 ASE_SPEC - - Operation speculatively executed, Advanced SIMD 
instruction. 

0x75 VFP_SPEC - - Operation speculatively executed, floating-point 
instruction. 

0x77 CRYPTO_SPEC - - Operation speculatively executed, Cryptographic 
instruction. 

@x7A BR_INDIRECT_ SPEC - - Branch that is speculatively executed - Indirect branch. 

0x86 EXC_IRQ - - Exception taken, IRQ. 

0x87 EXC _FIQ - - Exception taken, FIQ. 

@xCce - - - External memory request. 

@xC1 - - - Non-cacheable external memory request. 

@xCc2 - - - Linefill because of prefetch. 

@xC4 - - - Entering read allocate mode. 

@xc5 - - - Read allocate mode. 

@xC6 - - - Pre-decode error. 

@xC7 - - - Data Write operation that stalls the pipeline because the 
store buffer is full. 

@xC8 - - - SCU Snooped data from another core for this core. 

@xCc9 - - - Conditional branch that is executed. 

@xCA - - - Indirect branch that is mispredicted. 
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C2 PMU 
C2.3 Performance monitoring events 


Table C2-3 Performance monitoring events (continued) 





Number 


Event mnemonic 


PMU event 
bus to 
external 


PMU 
event bus 
to trace 


Event name 





@xCB 


Indirect branch that is mispredicted because of address 
miscompare. 





@xCC 


Conditional branch that is mispredicted. 





@xDO 


L1 Instruction Cache (data or tag) memory error. 





@xD1 


L1 Data Cache (data, tag, or dirty) memory error, 
correctable or non-correctable. 





@xD2 


TLB memory error. 





@xE@ 


Attributable Performance Impact Event. 


Counts every cycle that the DPU IQ is empty and that is 
not because of a recent micro-TLB miss, an instruction 
cache miss or a pre-decode error. 





@xE1 


Attributable Performance Impact Event. 


Counts every cycle the DPU IQ is empty and there is an 
instruction cache miss being processed. 





@xE2 


Attributable Performance Impact Event. 


Counts every cycle the DPU IQ is empty and there is an 
instruction micro-TLB miss being processed. 





@xE3 


Attributable Performance Impact Event. 


Counts every cycle the DPU IQ is empty and there is a 
pre-decode error being processed. 





@xE4 


Attributable Performance Impact Event. 


Counts every cycle there is an interlock that is not 
because of an Advanced SIMD or floating-point 
instruction, and not because of a load/store instruction 
waiting for data to calculate the address in the AGU. 


Stall cycles because of a stall in Wr, typically awaiting 
load data, are excluded. 





@xE5 


Attributable Performance Impact Event. 


Counts every cycle there is an interlock that is because 
of a load/store instruction waiting for data to calculate 
the address in the AGU. 


Stall cycles because of a stall in Wr, typically awaiting 
load data, are excluded. 





@xE6 

















Attributable Performance Impact Event. 


Counts every cycle there is an interlock that is because 
of an Advanced SIMD or floating-point instruction. 


Stall cycles because of a stall in the Wr stage, typically 
awaiting load data, are excluded. 
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C2 PMU 
C2.3 Performance monitoring events 


Table C2-3 Performance monitoring events (continued) 








Number | Event mnemonic PMU event PMU Event name 
bus to event bus 
external to trace 
@xE7 - - - Attributable Performance Impact Event 


Counts every cycle there is a stall in the Wr stage 
because of a load miss. 





OxE8 - - - Attributable Performance Impact Event. 


Counts every cycle there is a stall in the Wr stage 
because of a store. 









































- - [26] [26] L2 (data or tag) memory error, correctable or non- 
correctable. 

- - [27] [27] SCU snoop filter memory error, correctable or non- 
correctable. 

- - [28] - Advanced SIMD and floating-point retention active. 

- - [29] - Core retention active. 
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C2 PMU 
C2.4 PMU interrupts 


C2.4 PMU interrupts 


The processor asserts the nPMUIRQ signal when an interrupt occurs that the PMU generated. 


You can route this signal to an external interrupt controller for prioritization and masking. It is the only 
mechanism that signals this interrupt to the processor. 


This interrupt is also driven as a trigger input to the CTI. 


Related information 
C4.2 Cross-trigger inputs and outputs on page C4-579. 
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C2 PMU 
C2.5 Exporting PMU events 


C2.5 Exporting PMU events 


Some of the PMU events are exported to the ETM trace unit and the Cross Trigger Interface (CTI) to 
enable them to be monitored. Furthermore, the processor exports some PMU events on the PMUEVENT 
bus to external hardware. 


Related information 
Chapter C3 ETM on page C3-569. 
Chapter C4 CTI on page C4-577. 
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C2 PMU 
C2.5 Exporting PMU events 
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Chapter C3 
ETM 


This chapter describes the Embedded Trace Macrocell (ETM) of the processor. 


It contains the following sections: 

e (C3.1 About the ETM on page C3-570. 

e (3.2 Configuration options for the ETM unit and trace resources on page C3-572. 
e (C3.3 Resetting the ETM on page C3-574. 

e C3.4 Programming and reading ETM trace unit registers on page C3-575. 
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C3 ETM 
C3.1 About the ETM 


C3.1 About the ETM 


The ETM trace unit is a build-time configuration option. This module performs real-time instruction 
flow tracing that complies with the ETM architecture. As a CoreSight component, it is part of the ARM 
real-time debug solution. 


ETM 
—_—— CLKIN——> 





AT CLKEN =——— Trace out | SyncBridge ——ATB——> 


i 





























4 , Filtering and triggering 
peruse resources FIFO 
Processor Processor ; 
interface > interface block Trace generation 





























Figure C3-1 ETM functional blocks 


Filtering and triggering resources 
You can limit the amount of trace data that the ETM generates through filtering. For example, 
you can configure the ETM to generate trace only in a certain address range. More complicated 
filtering options, in the style of a logic analyzer, are also available. 


The ETM trace unit can also generate a trigger signal to the Trace Capture Device to stop 
capturing trace. 


Processor interface 
Monitors the behavior of the processor and generates PO elements that are executed instructions 
and exceptions that the ETM traces in program order. 

Trace generation 
Generates various trace packets that are based on PO elements. 

FIFO 
The ETM generates trace in a highly compressed form. The FIFO can flatten trace bursts. When 
it becomes full, it signals overflow so that the trace generation logic does not generate any new 
trace until the FIFO becomes empty. The period without trace generation results in a gap in the 
trace in the debugger view. 

Trace out 
Trace from FIFO is output on the synchronous ATB interface. 

Syncbridge 
The ATB interface from the trace out block goes through an ATB synchronous bridge. 


Interaction with the Performance Monitoring Unit (PMU) 
The processor includes a PMU that enables counting events, such as cache misses, over a 
period. All PMU architectural events are available to the ETM trace unit through the extended 
input facility. The ETM trace unit uses four extended external input selectors to access the PMU 
events. Each selector can independently select one of the PMU events, which is then active for 
the cycles where the relevant events occur. Any ETM event register can access the selected 
event. 


The processor supports only a memory-mapped interface to trace registers. 


All trace register accesses through the external debug interface behave as if the processor power domain 
is powered down when debug double lock is set. 
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C3 ETM 
C3.1 About the ETM 


Related information 
ARM® CoreSight Architecture Specification. 
Chapter C2 PMU on page C2-559. 
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C3 ETM 
C3.2 Configuration options for the ETM unit and trace resources 


C3.2 Configuration options for the ETM unit and trace resources 


The ETM unit is configurable. The processor implements options for the ETM unit and its resources. 


Table C3-1 Configuration of trace generation 


























Description Configuration 
Instruction address size in bytes 8 

Data address size in bytes 0 

Data value size in bytes 0 

Virtual Machine ID size in bytes 1 

Context ID size in bytes 4 

Support for conditional instruction tracing Not implemented 
Support for tracing of data Not implemented 





Support for tracing of load and store instructions as PO elements | Not implemented 





















































Support for cycle counting in the instruction trace Implemented 
Support for branch broadcast tracing Implemented 
Exception levels implemented in Non-secure state EL2, EL1, ELO 
Exception levels implemented in Secure state EL3, EL1, ELO 
Number of events supported in the trace 4 

Return stack support Implemented 
Tracing of SError exception support Implemented 
Instruction trace cycle counting minimum threshold 1 

Size of Trace ID 7 bits 
Synchronization period support Read-write 
Global timestamp size 64 bits 
Number of cores available for tracing 1 

ATB trigger support Implemented 
Low-power behavior override Implemented 
Stall control support Implemented 
Support for no overflows in the trace Not implemented 











Table C3-2 Configuration of trace resources 
































Description Configuration 

Number of resource selection pairs implemented 8 

Number of external input selectors implemented 4 

Number of external inputs implemented 30, 4 CTI + 26 PMU 

Number of counters implemented 2 

Reduced function counter implemented Not implemented 
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C3 ETM 
C3.2 Configuration options for the ETM unit and trace resources 


Table C3-2 Configuration of trace resources (continued) 















































Description Configuration 
Number of sequencer states implemented 4 

Number of Virtual Machine ID comparators implemented | 1 

Number of Context ID comparators implemented 1 

Number of address comparator pairs implemented 4 

Number of single-shot comparator controls 1 

Number of processor comparator inputs implemented 0 

Data address comparisons implemented Not implemented 
Number of data value comparators implemented 0 
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C3 ETM 
C3.3 Resetting the ETM 


C3.3 Resetting the ETM 


The reset for the ETM trace unit is the same as a cold reset for the processor. If the ETM trace unit is 
reset, tracing stops until the ETM trace unit is reprogrammed and re-enabled. 


A warm reset of the processor does not reset the ETM trace unit. Therefore it is possible to trace through 
warm processor reset. However, if the processor is reset using warm reset, the trace unit might not be 
able to trace the last few instructions before the reset. 
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C3 ETM 
C3.4 Programming and reading ETM trace unit registers 


C3.4 Programming and reading ETM trace unit registers 
You program and read the ETM trace unit registers using the Debug APB interface. 
The processor does not have to be in the debug state while you program the ETM trace unit registers. 


When you are programming the ETM trace unit registers, you must enable all the changes at the same 
time. Otherwise if you reprogram the counter, it might start to count based on incorrect events before the 
correct setup is in place for the trigger condition. 


To disable the ETM trace unit, use the TRCPRGCTLR.EN bit. 


( Start ) 


Yy 
Set main enable bit in 
TRCPRGCTLR to 0b0 








v 





Read TRCSTATR 














No 






Is TRCSTATR Idle 
0b1? 


Yes 


v 





Program all trace 
registers required 
y 
Set main enable bit in 
TRCPRGCTLR to 0b1 


aaay 
y 


Read TRCSTATR 

































Is TRCSTATR Idle 
Ob0? 


Yes 


End 


Figure C3-2 Programming ETM trace unit registers 


Related information 
C11.2 Programming Control Register on page C11-704. 
C11.3 Status Register on page C11-705. 
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C3 ETM 
C3.4 Programming and reading ETM trace unit registers 
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Chapter C4 
CTI 


This chapter describes the cross-trigger components of the processor. 


It contains the following sections: 
e (C4.1 About the cross-trigger on page C4-578. 
e C4.2 Cross-trigger inputs and outputs on page C4-579. 
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C4 CTI 
C4.1 About the cross-trigger 


C4.1 About the cross-trigger 


The Cross-Trigger Interface (CTI) enables the debug logic, ETM trace unit, and PMU to interact with 
each other and with other CoreSight components. For example, you configure the CTI to generate an 
interrupt when the ETM trace unit trigger event occurs. 


The single external cross-trigger channel interface of the processor connects to the CTI of each core 
through a Cross Trigger Matrix (CTM). Trigger inputs and trigger outputs connect debug components in 
the processor and CoreSight CTI blocks. The external CTM output is driven by the OR of the internal 
CTI outputs. Each internal CTI input is driven by the OR of the other internal CTI outputs and the 
external CTM input. 



































































































































































































































Processor 
Core 3 Governor 
Core 2 
Core 1 
Core 0 
> PMUEVENT[Z29:0] 
> nPMUIRQ[CN:0] 
i CSCTI3 
o PMU CSCTI2 
z CSCTI 1 
g CSCTIO 
Ww 
2 
a H CTIIRQ[CN:0] 
> le CTIIRQACK[CN:0 
ETM }@—————EXTIN[3:0] R I ] 
EXTOUT[3:0]— > 
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Debug trigger. >| 
l¢———Debug restart: 
Debug nCOMMIRQ—— LI 
COMMRX—— 
COMMTX—— 
a d$ 
3 Z 
2o 
° È 
Fo 
(8) 
y 
> CTICHOUT[3:0] 
CTICHOUTACKY[3:0] 
CTM 
CTICHIN[3:0] 
> CTICHINACK[3:0] 
> nCOMMIRQ[CN:0] 
> COMMRX[CN:0] 
> COMMTX[CN:0] 
EDBGRQ[CN:0] 
Figure C4-1 Cross-trigger components 
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C4.2 Cross-trigger inputs and outputs 


C4 CTI 
C4.2 Cross-trigger inputs and outputs 


Outputs from the PMU, the ETM, and the debug subsystem are cross-trigger inputs to the processor CTI. 
The CTI then generates cross-trigger outputs to other components in the SoC. 


Table C4-1 Cross-trigger inputs 

























































































CTI input | Name Description 
0 DBGTRIGGER, pulsed | Pulsed on entry to debug state. 
1 PMUIRQ PMU-generated interrupt. 
This signal is the same as nPMUIRQ with inverted polarity. 
2 3 > 
3 = i 
4 EXTOUT[0] Output from the ETM unit of Core<N>. 
5 EXTOUT[I1] 
6 EXTOUT[2] 
7 EXTOUT{3] 
Table C4-2 Cross-trigger outputs 
CTI output | Name Description 
0 EDBGRQ Causes the processor to enter debug state 
1 DBGRESTART | Causes the processor to exit debug state 
2 CTIIRQ CTI interrupt 
3 > z 
4 EXTIN[0] ETM trace unit external input 
5 EXTIN[1] ETM trace unit external input 
6 EXTIN[2] ETM trace unit external input 
74 EXTIN[3] ETM trace unit external input 
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C4 CTI 
C4.2 Cross-trigger inputs and outputs 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights reserved. C4-580 
Non-Confidential 


Chapter C5 
Direct access to internal memory 


This chapter describes the direct access to internal memory that caches and TLBs use. 


It contains the following sections: 

e C5.1 About direct access to internal memory on page C5-582. 

e (5.2 Encoding for tag and data in the L1 instruction cache on page C5-583. 
e (5.3 Encoding for tag and data in the L] data cache on page C5-584. 

e 5.4 Encoding for the main TLB RAM on page C5-586. 

e (5.5 Encoding for walk cache on page C5-591. 

e (5.6 Encoding for IPA cache on page C5-592. 
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C5.1 


About direct access to internal memory 


C5 Direct access to internal memory 
C5.1 About direct access to internal memory 


System registers provide access to the internal memory that the caches and TLBs use. This functionality 
can be useful when investigating issues where the coherency between the data in the cache and data in 


system memory is broken. 


In the AArch64 execution state, the appropriate memory block and location are selected using write-only 
registers and the data is read from read-only registers. These operations are available only in EL3. In all 
other modes, executing these instruction results in an Undefined Instruction exception. 


Table C5-1 AArch64 registers used to access internal memory 









































Function Access | Operation Rd Data 

Data Register 0 Read-only |MRS <Xd>, S3_3_c15_c@_@| Data 

Data Register 1 Read-only | MRS <Xd>, S3_3_c15_c@_1/ Data 

Data Register 2 Read-only | MRS <Xd>, S3_3_c15_c@_ 2) Data 

Data Register 3 Read-only | MRS <Xd>, S3_3_c15_c@_3/ Data 

Data Cache Tag Read Operation Register Write-only | MSR S3_3_c15_c2_0, <Xd> | Set/Way 
Instruction Cache Tag Read Operation Register | Write-only | MSR $3_3_c15_c2_1, <Xd> | Set/Way 

Data Cache Data Read Operation Register Write-only | MSR S3_3_c15_c4_@, <Xd> | Set/Way/Offset 
Instruction Cache Data Read Operation Register | Write-only | MSR S3_3_c15_c4_1, <Xd> | Set/Way/Offset 
TLB Data Read Operation Register Write-only | MSR S3_3_c15_c4_2, <Xd> | Index/Way 











In the AArch32 execution state, the appropriate memory block and location are selected using write-only 
CP15 registers and the data is read from read-only CP15 registers. These operations are available only in 
EL3. In all other modes, executing the CP15 instruction results in an Undefined Instruction exception. 


Table C5-2 AArch32 CP15 registers used to access internal memory 
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Function Access |CP15 operation Rd Data 
Data Register 0 Read-only | MRC p15, 3, <Rd>, c15, c0, @| Data 
Data Register 1 Read-only | MRC p15, 3, <Rd>, c15, c@, 1/ Data 
Data Register 2 Read-only | MRC p15, 3, <Rd>, c15, c@, 2 |Data 
Data Register 3 Read-only | MRC p15, 3, <Rd>, c15, c@, 3| Data 
Data Cache Tag Read Operation Register Write-only | MCR p15, 3, <Rd>, c15, c2, @| Set/Way 
Instruction Cache Tag Read Operation Register | Write-only | MCR p15, 3, <Rd>, c15, c2, 1] Set/Way 
Data Cache Data Read Operation Register Write-only | MCR p15, 3, <Rd>, c15, c4, @| Set/Way/Offset 
Instruction Cache Data Read Operation Register | Write-only | MCR p15, 3, <Rd>, c15, c4, 1| Set/Way/Offset 
TLB Data Read Operation Register Write-only | MCR p15, 3, <Rd>, c15, c4, 2 Index/Way 
Related information 
C5.4 Encoding for the main TLB RAM on page C5-586. 
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C5.2 Encoding for tag and data in the L1 instruction cache 
The following table shows the format of the Instruction Cache Tag Read Operation Register and the 
Instruction Cache Data Read Operation Register. 
The set-index range parameter (S) is determined by the following formula: 
S = log»(size of the instruction cache in bytes / 2) 
Table C5-3 Instruction cache tag and data location encoding 
Bit field | Description 
[31] Cache Way 
[30:S] Unused 
[S-1:6] | Set index 
[5:2] Line offset 
[1:0] Unused 
The following table shows the format of the information in Data Register 0 following an Instruction 
Cache Tag Read Operation. 
Table C5-4 Instruction cache tag data format 
Bits Description 
[31] Unused. 
[30:29] | Valid and set mode: 
e@bee A32. 
@be1 T32; 
0b10 A64. 
@b11 Invalid. 
[28] Non-secure state (NS). 
[27:0] | Tag address. 
The Instruction Cache Data Read Operation returns two entries from the cache in Data Register 0 and 
Data Register 1 corresponding to the 16-bit aligned offset in the cache line: 
Data Register 0 Bits[19:0] data from cache offset+ @bee. 
Data Register 1 Bits[19:0] data from cache offset+ @b10. 
In A32 or A64 state these two fields combined always represent a single predecoded instruction. In T32 
state, they can represent any combination of 16-bit and partial or full 32-bit instructions. 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights C5-583 


reserved. 
Non-Confidential 


C5 Direct access to internal memory 
C5.3 Encoding for tag and data in the L1 data cache 


C5.3 Encoding for tag and data in the L1 data cache 


The following table shows the format of the Data Cache Tag Read Operation Register and the Data 
Cache Data Read Operation Register. The Data Cache Tag Read Operation and the Data Cache Data 
Read Operation use the same encoding but the latter includes an additional field to locate the appropriate 
doubleword in the cache line. 


The set-index range parameter (S) is determined by the following formula: 


S = log,(size of the data cache in bytes/4). 


Table C5-5 Data cache tag and data location encoding 





Bit field | Description 





[31:30] | Cache way 





[29:S] Unused 





[S-1:6] | Set index 





[5:3] Cache doubleword data offset (Data Cache Data Read Operation Register only) 














[2:0] Unused, RAZ. 





The Data Cache Tag Read Operation returns 64 bits of data in Data Register 0 and Data Register 1. This 
includes the tag information, MOESI coherency state, outer attributes, and valid bit, for the selected 
cache line. The following table shows the format of the return value. The Cortex-A35 processor encodes 
the 4-bit MOESI coherency state across two fields of Data Register 0 and Data Register 1. 


Table C5-6 Data cache tag data format 





Register Bit field | Description 





Data Register 1 | [31] Parity bit if ECC is implemented, otherwise RESO. 





Data Register 1 | [30:29] | Partial MOESI State, from tag RAM. See Zable C5-7 MOESI state on page C5-585. 





Data Register 1 | [28] Non-secure state (NS). 





Data Register 1 | [27:0] Tag Address [39:12]. 





Data Register 0 | [31] Tag Address [11]. 





Data Register 0 | [30:5] Reserved, RESO. 


























Data Register 0 | [4] Parity bit if ECC is implemented, otherwise RESO. 

Data Register 0 | [3] Dirty copy bit if ECC is implemented, otherwise RESO. 

Data Register 0 | [2] Outer Allocation Hint. 

Data Register 0 | [1] Outer Shareability, from Dirty RAM. 

Data Register 0 | [0] Partial MOESI state, from Dirty RAM. See Zable C5-7 MOESI state on page C5-585. 








The Data Cache Data Read Operation returns two entries from the cache in Data Register 0 and Data 
Register 1 corresponding to the 16-bit aligned offset in the cache line: 








Data Register 0 Bits[31:0] data from cache offset+ @bee0. 
Data Register 1 Bits[31:0] data from cache offset+ @b100. 
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Table C5-7 MOESI state 




















Tag RAM partial MOESI bits | Dirty RAM partial MOESI bits | MOESI state 

00 x Invalid (1) 

01 0 SharedClean (S) 
1 SharedDirty (O) 

Ix 0 UniqueClean (E) 
1 UniqueDirty (M) 

















Related information 
A5.2 Coherency between data caches with the MOESI protocol on page AS-75. 
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C5.4 Encoding for the main TLB RAM 


The Cortex-A35 processor unified TLB is built from a 2-way set-associative RAM based structure. To 
read the individual entries into the data registers, software must write to the TLB Data Read Operation 
Register. 


The following table shows the format of the TLB Data Read Operation Register. 


Table C5-8 Location encoding for the TLB Data Read Operation Register 





Bits |Description 





[31] | Unused 





[30] | TLB way 





[29:9] | Unused 





[8:0] | TLB index 

















0-255 Main TLB RAM 
256-287 Walk cache RAM 
288-319 IPA cache RAM 
320-511 Unused 
The TLB Read Data Operation returns the selected entry in Data Register 0-3. The entry uses a 116-bit 
encoding when parity is enabled and a 113-bit encoding when parity is disabled. 
Data Register 0[31:0] TLB Descriptor[31:0]. 
Data Register 1[31:0] TLB Descriptor[63:32]. 
Data Register 2[31:0] TLB Descriptor[95:64]. 
Data Register 3[20:0] TLB Descriptor[115:96]. 
The following table shows the data fields in the TLB descriptor. 
Table C5-9 Main TLB descriptor data fields 
Bits Name Description 





[115:113] | Parity 


If CPU cache protection is not implemented, these bits are absent. 











[112:111] | S2 Level The stage 2 level that gave this translation: 


e@bee No stage 2 translation performed. 
@be1 Level 1. 
@b10 Level 2. 
@b11 Level 3. 
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Table C5-9 Main TLB descriptor data fields (continued) 





Bits 


Name 


Description 





[110:108] 


S1 Size 


The stage 1 size that gave this translation. 
VMSAv8-32 Short-descriptor translation table format: 
@beee 4KB. 

0b010 64KB. 


b011 IMB. 
@b101 16MB. 


In the VMSAv8-32 Long-descriptor translation table format and the VMSAv8-64 translation 
table format, domain[2] is used in conjunction with S1 Size, {domain[2], S1 size}: 


@beeee@ 4KB. 
@beee1 16KB. 
@bee10 64KB. 
@be100 2MB. 
0b0110 32MB. 
0b0111 512MB. 
0b1111 1GB. 





[107:104] 


Domain 


In VMSAv7 format, indicates one of sixteen memory regions. 
In non-VMSAv7 formats: 


e Domain[0] stores the contiguous bit information. 


e Domain[1] stores the page size MSB for the combined page size. 


e Domain[2] stores the page size MSB for the stage 1 page size. 





[103:96] 


Memory Type and 
shareability 


See TLB encoding for memory types and shareability. 





[95] 


XS2 


Stage2 executable permissions. 





[94] 


XS 1Nonusr 


Non user mode executable permissions. 





[93] 


XS1Usr 


User mode executable permissions. 





[92-65] 


PA 


Physical Address. 








[64] 


NS, descriptor 


Security state allocated to memory region. 





[63:62] 


HAP 


Hypervisor access permissions. 





[61:59] 


AP or HYP 


Access permissions from stage-1 translation, or select EL2 or flag. 





[58] 








nG 





Not global. 
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Table C5-9 Main TLB descriptor data fields (continued) 





Bits Name Description 





[57:55] Size This field shows the encoding for the combined page size for stage 1 and stage 2. 


VMSAv8s-32 Short-descriptor translation table format: 


ebeee 4KB. 
@be10 64KB. 
0b100 IMB. 


0b110 16MB. 


In the VMSAv8-32 Long-descriptor translation table format and the VMSAv8-64 translation 
table format, domain[1] is used in conjunction with Size, {domain[1], Size}: 

@beee1 4KB. 

0b1001 16KB. 

@bee@11 64KB. 

0b0101 2MB. 

0b1011 32MB. 

0b0111 512MB. 




















[54:39] | ASID Address Space Identifier. 
[38:31] | VMID Virtual Machine Identifier. 
[30] NS (walk) Security state that the entry was fetched in. 
[29:2] VA Virtual Address. 
[1] Address Sign bit VA[48] sign bit. 
[0] Valid Valid bit: 
(2 Entry does not contain valid data. 


1 Entry contains valid data. 














The following table shows the main TLB memory types and shareability. 


Table C5-10 TLB encoding for memory types and shareability 





Bits | Memory type Description 





[7] | Device 0 
Non-coherent, Outer WB 
Non-coherent, Outer NC 


Non-coherent, Outer WT 





= 


Coherent, Inner WB and Outer WB 
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Table C5-10 TLB encoding for memory types and shareability (continued) 





























Bits | Memory type Description 
[6] | Device 0 
Non-coherent, Outer WB 
Non-coherent, Outer NC 1 
Non-coherent, Outer WT 
Coherent, Inner WB and Outer WB | Transience: 
(2) Non-transient 
1 Transient. 
[5:4] | Device Stage 1 (Non-device) overridden by stage 2 (Device) 
ee Not overridden 
01 Overridden. 
Non-coherent, Outer WB Inner type: 
10 NC. 
11 WT. 
Non-coherent, Outer NC 11 
Non-coherent, Outer WT Inner type: 
ee NC. 
01 WB. 
10 WT. 








Coherent, Inner WB and Outer WB 





Inner allocation hint: 


ee NA. 
o1 WA. 
10 RA. 
11 WRA. 
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Table C5-10 TLB encoding for memory types and shareability (continued) 

















Bits | Memory type Description 
[3:2] | Device Device type: 
ee nGnRnE. 
01 nGnRE. 
10 nGRE. 
11 GRE. 
Non-coherent, Outer WB Outer allocation hint: 
Non-coherent, Outer WT 00 NA. 
Coherent, Inner WB and Outer WB 01 WA. 
10 RA. 
11 WRA. 
Non-coherent, Outer NC Inner type: 
62 NC. 
o1 WB. 
10 WT. 
11 Unused. 

[1:0] | Device Shareability: 
Non-coherent, Outer WB 00 Non-shareable. 
Non-coherent, Outer NC 01 Unused. 
Non-coherent, Outer WT 19 Cuter shareable, 
Coherent, Inner WB and Outer WB - i i 

















Related information 

C5.5 Encoding for walk cache on page C5-591. 

C5.6 Encoding for IPA cache on page C5-592. 

C5.1 About direct access to internal memory on page C5-582. 
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C5.5 Encoding for walk cache 
The following table shows the data fields in the walk cache descriptor. 
Table C5-11 Walk cache descriptor fields 
Bits Name Description 
[115:113] | Parity bits | If CPU cache protection is not implemented, these bits are absent. 
[112:83] | PA Physical Address of the second, last, translation level. 
[82:60] | VA Virtual address. 
[59] VA sign | Virtual address sign bit. 
[58:55] |- Reserved, must be zero. 
[54:39] ASID Address Space Identifier. 
[38:31] | VMID Virtual Machine Identifier. 
[30] NS, walk | Security state that the entry was fetched in. 
[29:23] - Reserved, must be zero. 
[22:19] |Domain | Valid only if the entry was fetched in VMSAv7 format. 
[18:16] | Entry size | Memory size to which entry maps: 
0b100 IMB. 
@b101 2MB. 
0b010 SMB. 
@b110, 0b011 32MB. 
e@bee1 128MB. 
@b111 512MB. 
[15] NSTable | Combined NSTable bits from first and second-level stage 1 tables or NS descriptor (VMSA). 
[14] PXNTable | Combined PXNTable bits from stage! descriptors up to last level. 
[13] XNTable | Combined XNTable bit from stage1 descriptors up to last level. 
[12:11] |APTable | Combined APTable bits from stagel descriptors up to last level. 
[10] EL3 Set if the entry was fetched in AArch64 EL3 mode. 
[9] EL2 Set if the entry was fetched in EL2 mode. 
[8:1] Attrs Physical attributes of the final level stage 1 table. 
[0] Valid Valid bit: 
2) Entry does not contain valid data. 
1 Entry contains valid data. 
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C5.6 Encoding for IPA cache 
The following table shows the data fields in the IPA cache descriptor. 
Table C5-12 IPA cache descriptor fields 
Bits Name Description 
[115:113] | Parity bits If CPU cache protection is not implemented, these bits are absent. 
[112:85] | PA Physical address. 
[84:62] | IPA Unused lower bits, page size dependent, must be zero. 
[61:59] - Reserved, must be zero. 
[58:55] | Size Stage 2 page size. The values are: 
0b0001 4KB. 
0b1001 16KB. 
@bee11 64KB. 
@be101 2MB. 
@b1011 32MB. 
0b0111 512MB. 
[54:39] |- Reserved, must be zero. 
[38:31] | VMID Virtual Machine Identifier. 
[30:12] |- Reserved, must be zero. 
[11:10] | Entry granule | The values are: 
ebee A4KB. 
0b10 16KB. 
@be1 64KB. 
[9:6] Memattrs Memory attributes. 
[5] XN Execute Never. 
[4:3] HAP Hypervisor access permissions. 
[2:1] SH Shareability. 
[0] Valid The entry contains valid data. 
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Chapter C6 
AArch32 debug registers 


This chapter describes the debug registers in the AArch32 execution state and shows examples of how to 
use them. 


It contains the following sections: 

e (C6.1 AArch32 debug register summary on page C6-594. 

e (6.2 Debug Breakpoint Control Registers on page C6-596. 
e (C6.3 Debug Watchpoint Control Registers on page C6-599. 
e C6.4 Debug ID Register on page C6-601. 

e (C6.5 Debug Device ID Register on page C6-603. 

e (C6.6 Debug Device ID Register 1 on page C6-605. 
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C6.1 AArch32 debug register summary 
This section summarizes the 32-bit and 64-bit debug control registers that are accessible in the AArch32 
Execution state from the internal CP14 interface. 
These registers, listed in the following table, are accessed by the MCR and MRC instructions in the order of 
CRn, op2, CRm, Op1 or MCRR and MRRC instructions in the order of CRm, Op1. For those registers not 
described in this chapter, see the ARM” Architecture Reference Manual ARMv6, for ARMv8-A 
architecture profile. 
See the C8./ Memory-mapped debug register summary on page C8-616 for a complete list of registers 
accessible from the external debug interface. 
Table C6-1 AArch32 debug register summary 
CRn | Op2 | CRm | Op1 | Name Type | Description 
c0 0 c0 0 DBGDIDR RO | C6.4 Debug ID Register on page C6-601 
c0 0 cl 0 DBGDSCRint RO | Debug Status and Control Register, Internal View 
c0 0 c2 0 DBGDCCINT RW | Debug Comms Channel Interrupt Enable Register 
c0 0 c5 0 DBGDTRTXint WO | Debug Data Transfer Register, Transmit, Internal View 
DBGDTRRXint RO | Debug Data Transfer Register, Receive, Internal View 
c0 0 c6 0 DBGWFAR RW | Watchpoint Fault Address Register, RESO 
Previously returned information about the address of the instruction that 
accessed a watchpoint address. This register is now deprecated and is RESO. 
c0 0 c7 0 DBGVCR RW _| Debug Vector Catch Register 
c0 2 c0 0 DBGDTRRXext RW _| Debug Data Transfer Register, Receive, External View 
c0 2 c2 0 DBGDSCRext RW |Debug Status and Control Register, External View 
c0 2 c3 0 DBGDTRTXext RW |Debug Data Transfer Register, Transmit, External View 
c0 2 c6 0 DBGOSECCR RW |Debug OS Lock Exception Catch Control Register 
c0 4 c0 0 DBGBVRO RW _| Debug Breakpoint Value Register 0 
c0 4 cl 0 DBGBVRI1 RW _| Debug Breakpoint Value Register 1 
c0 4 c2 0 DBGBVR2 RW _| Debug Breakpoint Value Register 2 
c0 4 c3 0 DBGBVR3 RW | Debug Breakpoint Value Register 3 
c0 4 c4 0 DBGBVR4 RW _| Debug Breakpoint Value Register 4 
c0 4 c5 0 DBGBVR5 RW _| Debug Breakpoint Value Register 5 
c0 5 c0 0 DBGBCRO RW | C6.2 Debug Breakpoint Control Registers on page C6-596 
c0 5 cl 0 DBGBCR1 RW 
c0 5 c2 0 DBGBCR2 RW 
c0 5 63 0 DBGBCR3 RW 
c0 5 c4 0 DBGBCR4 RW 
c0 5 c5 0 DBGBCR5 RW 
c0 6 c0 0 DBGWVRO RW | Debug Watchpoint Value Register 0 
c0 6 cl 0 DBGWVRI1 RW | Debug Watchpoint Value Register 1 
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Table C6-1 AArch32 debug register summary (continued) 




























































































CRn | Op2 | CRm | Op1 | Name Type | Description 

c0 6 c2 0 DBGWVR2 RW | Debug Watchpoint Value Register 2 

c0 6 c3 0 DBGWVR3 RW | Debug Watchpoint Value Register 3 

c0 7 c0 0 DBGWCRO RW | C6.3 Debug Watchpoint Control Registers on page C6-599 

c0 7 cl 0 DBGWCR1 RW 

c0 7 c2 0 DBGWCR2 RW 

c0 7 3 0 DBGWCR3 RW 

cl 0 c0 0 DBGDRAR{31:0] RO | Debug ROM Address Register 

- - cl - DBGDRAR[63:0] RO 

cl 1 c4 0 DBGBXVR4 RW _| Debug Breakpoint Extended Value Register 4 

cl 1 c5 0 DBGBXVRS5 RW _| Debug Breakpoint Extended Value Register 5 

cl 4 c0 0 DBGOSLAR WO | Debug OS Lock Access Register 

cl 4 cl 0 DBGOSLSR RO | Debug OS Lock Status Register 

cl 4 c3 0 DBGOSDLR RW |Debug OS Double Lock Register 

cl 4 c4 0 DBGPRCR RW _| Debug Power/Reset Control Register 

c2 2 c0 0 DBGDSARJ31:0] RO | Debug Self Address Register RESO 

- 0 c2 - DBGDSAR[63:0] RO _ | Previously defined the offset from the base address defined in DBGDRAR 
of the physical base address of the debug registers for the processor. This 
register is now deprecated and RESO. 

c7 7 c0 0 DBGDEVID2 RO | Debug Device ID Register 2, RESO 

c7 7 cl 0 DBGDEVID1 RO | C6.6 Debug Device ID Register 1 on page C6-605 

c7 7 c2 0 DBGDEVID RO | C6.5 Debug Device ID Register on page C6-603 

c7 6 c8 0 DBGCLAIMSET RW |Debug Claim Tag Set Register 

c7 6 c9 0 DBGCLAIMCLR RW _| Debug Claim Tag Clear Register 

c7 6 cl4 JO DBGAUTHSTATUS | RO | Debug Authentication Status Register 
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C6.2 Debug Breakpoint Control Registers 
The DBGBCRza characteristics are: 


Purpose 
Holds control information for a breakpoint. Each DBGBVR is associated with a DBGBCR to 
form a Breakpoint Register Pair (BRP). DBGBVRz is associated with DBGBCRz to form 
BRPn. 


The range ofn for DBGBCRz is 0 to 5. 


Usage constraints 
These registers are accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW |RW | RW | RW RW 


























Configurations 
DBGBCRz are architecturally mapped to: 
e The AArch64 DBGBCRn_EL] registers. See C7.2 Debug Breakpoint Control Registers, 
EL1 on page C7-610. 
e The external DBGBCRza registers. 


Attributes 
See C6.1 AArch32 debug register summary on page C6-594. 


The debug logic reset value of a DBGBCRu is UNKNOWN. 


31 24 23 20 19 16 15 14 13 12 5 432 1 0 


Figure C6-1 DBGBCR 


[31:24] 
Reserved, RESO. 

BT, [23:20] 
Breakpoint Type. This field controls the behavior of Breakpoint debug event generation. This 
includes the meaning of the value held in the associated DBGBVRz, indicating whether it is an 
instruction address match or mismatch or a Context match. It also controls whether the 
breakpoint is linked to another breakpoint. The possible values are: 





@beeee Unlinked instruction address match. 
@beee1 Linked instruction address match. 
@bee1@ Unlinked Context ID match. 

@be@e11 Linked Context ID match. 

@be1ee Unlinked instruction address mismatch. 
@b@101 Linked instruction address mismatch. 
@b10e0 Unlinked VMID match. 

@b1001 Linked VMID match. 

@b101@ Unlinked VMID + Context ID match. 


@b1011 Linked VMID + Context ID match. 


All other values are reserved. 
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The field break down is: 
e BTT[3:1]: Base type. If the breakpoint is not context-aware, these bits are Reso. Otherwise, the 
possible values are: 
@beee@ Match address. DBGBVRz is the address of an instruction. 
@bee1 Match context ID. DBGBVRn[31:0] is a context ID. 
@be@18@ Mismatch address. Behaves as type 0b000 if halting debug-mode is enabled and 
halting is allowed. 
Otherwise, DBGBVRz is the address of an instruction to be stepped. 


b100 Match VMID. DBGBVRa[7:0] is a VMID. 


@b101 Match VMID and context ID. DBGBVRn[31:0] is a context ID, and 
DBGBVRz[7:0] is a VMID. 


e BT[0]: Enable linking. 


LBN, [19:16] 


Linked breakpoint number. For Linked address matching breakpoints, this specifies the index of 
the Context-matching breakpoint linked to. 


SSC, [15:14] 


Security State Control. Determines the security states that a breakpoint debug event for 
breakpoint 7 is generated. 


This field must be interpreted with the Higher Mode Control (HMC), and Privileged Mode 
Control (PMC), fields to determine the mode and security states that can be tested. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for 
possible values of the fields. 


HMC, [13] 


[12:9] 


Hyp Mode Control bit. Determines the debug perspective for deciding when a breakpoint debug 
event for breakpoint n is generated. 


This bit must be interpreted with the SSC and PMC fields to determine the mode and security 
states that can be tested. 


See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for 
possible values of the fields. 


Reserved, RESO. 


BAS, [8:5] 


[4:3] 


Byte Address Select. Defines which half-words a regular breakpoint matches, regardless of the 
instruction set and execution state. A debugger must program this field as follows: 


0x3 Match the T32 instruction at DBGBVRn. 

@xC Match the T32 instruction at DBGBVRn+2. 

OxF Match the A64 or A32 instruction at DBGBVRz, or context match. 
All other values are reserved. 


The ARMv8-A architecture does not support direct execution of Java bytecodes. BAS[3] and 
BAS[1] ignore writes and on reads return the values of BAS[2] and BAS[0] respectively. 


See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for 
more information on how the BAS field is interpreted by hardware. 


Reserved, RESO. 
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PMC, [2:1] 


Privileged Mode Control. Determines the exception level or levels that a breakpoint debug event 
for breakpoint n is generated. 


This field must be interpreted with the SSC and HMC fields to determine the mode and security 
states that can be tested. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for 
possible values of the fields. 


Bits[2:1] have no effect for accesses made in Hyp mode. 


Sa Enable breakpoint. This bit enables the BRP: 
(3) BRP disabled. 
1 BRP enabled. 
A BRP never generates a breakpoint debug event when it is disabled. 
The value of DBGBCRa.E is UNKNown on reset. A debugger must ensure that DBGBCRa.E has 
a defined value before it enables debug. 
To access the DBGBCRn: 


MRC p14, ©, <Rt>, c@, cn, 4; Read Debug Breakpoint Control Register n 
MCR p14, ©, <Rt>, c@, cn, 4; Write Debug Breakpoint Control Register n 


The DBGBCRn_EL!1 can be accessed through the external debug interface, offset @x4n8. The range of 
bits for DBGBCRn_EL] is 0 to 5. 
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C6.3 Debug Watchpoint Control Registers 
The DBGWCRa characteristics are: 


Purpose 
Holds control information for a watchpoint. Each DBGWCR is associated with a 
DBGWVR_ELI to form a Watchpoint Register Pair (WRP). DBGWCRaz is associated with 
DBGWVRn_ELI to form WRPn. 


The range ofn for DBGBCRz is 0 to 3. 


Usage constraints 
These registers are accessible as follows: 











ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW |RW | RW | RW RW 























Configurations 
The DBGWCRz are architecturally mapped to: 


e The AArch64 DBGWCRz registers. See C7.3 Debug Watchpoint Control Registers, EL] 
on page C7-613. 
¢ The external DBGWCRn_ELI registers. 


Attributes 
See C6.1 AArch32 debug register summary on page C6-594. 


The debug logic reset value of a DBGWCR_EL]1 is UNKNOWN. 


29 28 2423 212019 1615 14 13 12 543210 
L_wt L_HMC 


Figure C6-2 DBGWCR 

[31:29] 

Reserved, RESO. 
MASK, [28:24] 

Address mask. Only objects up to 2GB can be watched using a single mask. 

@beee8 No mask 

@beee1 Reserved 

@bee18 Reserved 


Other values mask the corresponding number of address bits, from @b@0011 masking 3 address 
bits (@x@@000007 mask for address) to @b11111 masking 31 address bits (@x7FFFFFFF mask for 
address). 
[23:21] 
Reserved, RESO. 
WT, [20] 
Watchpoint type. Possible values are: 
() Unlinked data address match. 
1 Linked data address match. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
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LBN, [19:16] 
Linked breakpoint number. For Linked data address watchpoints, this specifies the index of the 
Context-matching breakpoint linked to. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


SSC, [15:14] 
Security state control. Determines the Security states under which a watchpoint debug event for 
watchpoint n is generated. This field must be interpreted along with the HMC and PAC fields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


HMC, [13] 
Higher mode control. Determines the debug perspective for deciding when a watchpoint debug 
event for watchpoint n is generated. This field must be interpreted along with the SSC and 
PACfields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


BAS, [12:5] 
Byte address select. Each bit of this field selects whether a byte from within the word or double- 
word addressed by DBGWVRzu is being watched. See the ARM® Architecture Reference Manual 
ARMv6, for ARMv8-A architecture profile for more information. 

LSC, [4:3] 
Load/store access control. This field enables watchpoint matching on the type of access being 
made. The possible values are: 
@b@1 Match instructions that load from a watchpointed address. 
@b1@ Match instructions that store to a watchpointed address. 


@b11 Match instructions that load from or store to a watchpointed address. 


All other values are reserved, but must behave as if the watchpoint is disabled. Software must 
not rely on this property as the behavior of reserved values might change in a future revision of 
the architecture. 


Ignored if E is 0. 
On Cold reset, the field reset value is architecturally UNKNOWN. 


PAG, [2:1] 
Privilege of access control. Determines the exception level or levels at which a watchpoint 
debug event for watchpoint n is generated. This field must be interpreted along with the SSC 
and HMCfields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


E, [0] 

Enable watchpoint n. Possible values are: 

(3 Watchpoint disabled. 

1 Watchpoint enabled. 

On Cold reset, the field reset value is architecturally UNKNOWN. 
To access the DBGWCRx2: 


MRC p14, @, <Rt>, c@, cn, 7; Read Debug Watchpoint Control Register n 
MCR p14, @, <Rt>, c@, cn, 7; Write Debug Watchpoint Control Register n 


The DBGWCRzv_ELI can be accessed through the external debug interface, offset @x8n8. The range of n 
for DBGWCRn_EL1 is 0 to 3. 
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C6.4 Debug ID Register 
The DBGDIDR characteristics are: 


Purpose 
Specifies: 
¢ The version of the Debug architecture that is implemented. 
e Some features of the debug implementation. 


Usage constraints 
This register is accessible as follows: 



































ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
RO |RO |RO |RO |RO |RO RO 
Configurations 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes 


See C6.1 AArch32 debug register summary on page C6-594. 
28 27 24 23 20 19 16 15 14 13 12 11 0 


DEVID_imp — L 
nSUHD_imp C _imp 
Figure C6-3 DBGDIDR bit assignments 


WRPs, [31:28] 
The number of Watchpoint Register Pairs (WRPs) implemented. The number of implemented 
WRPs is one more than the value of this field. The value is: 


0x3 The processor implements 4 WRPs. 


This field has the same value as ID AA64DFRO_EL1.WRPs. 


BRPs, [27:24] 
The number of Breakpoint Register Pairs (BRPs) implemented. The number of implemented 
BRPs is one more than the value of this field. The value is: 


0x5 The processor implements 6 BRPs. 


This field has the same value as ID AA64DFRO_EL1.BRPs. 


CTX_CMPs, [23:20] 
The number of BRPs that can be used for Context matching. This is one more than the value of 
this field. The value is: 


0x1 The processor implements two Context matching breakpoints, breakpoints 4 and 5. 


This field has the same value as ID AA64DFRO_EL1.CTX_CMPs. 
Version, [19:16] 


The Debug architecture version. 
@x6 The processor implements ARMv8 Debug architecture. 
DEVID_imp, [15] 


Reserved, RAO. 
nSUHD_imp, [14] 
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Secure User Halting Debug not implemented bit. The value is: 
1 The processor does not implement Secure User Halting Debug. 


PCSR_imp, [13] 
Reserved, RAZ. 
SE, [12] 
EL3 implemented. The value is: 


1 The processor implements EL3. 
[11:0] 

Reserved, RESO. 
To access the DBGDIDR: 


MRC p14, ©, <Rt>, c@, c@, ©; Read Debug ID Register 
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C6.5 Debug Device ID Register 
The DBGDEVID characteristics are: 


Purpose 
Specifies the version of the Debug architecture is implemented, and some features of the debug 
implementation. 

Usage constraints 
This register is accessible as follows: 



































ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 
Configurations 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes 
See C6.1 AArch32 debug register summary on page C6-594. 
28 27 24 23 20 19 16 15 12 11 
| L WPAddrMask 
BPAddrMask 
VectorCatch 


Figure C6-4 DBGDEVID bit assignments 
CIDMask, [31:28] 


Specifies the level of support for the Context ID matching breakpoint masking capability. This 
value is: 


exe Context ID masking is not implemented. 
AuxRegs, [27:24] 
Specifies support for the Debug External Auxiliary Control Register. This value is: 
exe None supported. 
DoubleLock, [23:20] 
Specifies support for the Debug OS Double Lock Register. This value is: 
0x1 The processor supports Debug OS Double Lock Register. 


VirtExtns, [19:16] 
Specifies whether EL2 is implemented. This value is: 


0x1 The processor implements EL2. 


VectorCatch, [15:12] 
Defines the form of the vector catch event implemented. This value is: 


exe The processor implements address matching form of vector catch. 


BPAddrMask, [11:8] 


Indicates the level of support for the Immediate Virtual Address (IVA) matching breakpoint 
masking capability. This value is: 


@xF Breakpoint address masking not implemented. DBGBCRn[28:24] are REso. 
WPAddrMask, [7:4] 
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Indicates the level of support for the DVA matching watchpoint masking capability. This value 
is: 
ex1 Watchpoint address mask implemented. 

PCSample, [3:0] 


Indicates the level of support for Program Counter sampling using debug registers 40 and 41. 
This value is: 


0x3 EDPCSR, EDCIDSR and EDVIDSR are implemented as debug registers 40, 41, and 
42. 


To access the DBGDEVID: 


MRC p14, ©, <Rt>, c7, c2, 7; Read Debug Device ID Register @ 
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C6.6 Debug Device ID Register 1 
The DBGDEVID1 characteristics are: 


Purpose 
Adds to the information given by the DBGDIDR by describing other features of the debug 
implementation. 

Usage constraints 
This register is accessible as follows: 



































ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 
Configurations 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes 


See C6.1 AArch32 debug register summary on page C6-594. 
31 4 3 0 


PCSROffset =| 


Figure C6-5 DBGDEVID1 bit assignments 


[31:4] 
Reserved, RESO. 
PCSROffset, [3:0] 
Indicates the offset applied to PC samples returned by reads of EDPCSR. The value is: 


@x2 EDPCSR samples have no offset applied and do not sample the instruction set state in the 
AArch32 state. 


To access the DBGDEVID1: 


MRC p14, @, <Rt>, c7, c1, 47 Read Debug Device ID Register 1 
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Chapter C7 
AArch64 debug registers 


This chapter describes the debug registers in the AArch64 execution state and shows examples of how to 
use them. 


It contains the following sections: 

e C71 AArch64 debug register summary on page C7-608. 

e (7.2 Debug Breakpoint Control Registers, ELI on page C7-610. 
e C7.3 Debug Watchpoint Control Registers, EL] on page C7-613. 
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C7.1 AArch64 debug register summary 


This section summarizes the debug control registers that are accessible in the AArch64 Execution state. 


These registers, listed in the following table, are accessed by the MRS and MSR instructions in the order of 
Op0, CRn, Op1, CRm, Op?2. 


See C8.1 Memory-mapped debug register summary on page C8-616 for a complete list of registers 
accessible from the external debug interface. The 64-bit registers cover two addresses on the external 
memory interface. For those registers not described in this chapter, see the ARM” Architecture Reference 
Manual ARMv8, for ARMv8-A architecture profile. 


Table C7-1 AArch64 debug register summary 














Name Type | Reset Width | Description 

OSDTRRX EL1 RW |J- 32 Debug Data Transfer Register, Receive, External View 
DBGBVRO_ EL1 RW |J- 64 Debug Breakpoint Value Register 0 

DBGBCRO_EL1 RW |J- 32 C7.2 Debug Breakpoint Control Registers, EL1 


on page C7-610 














DBGWVRO EL1 RW |J- 64 Debug Watchpoint Value Register 0 

DBGWCRO_EL1 RW |J- 32 C7.3 Debug Watchpoint Control Registers, EL1 
on page C7-613 

DBGBVRI EL1 RW |J- 64 Debug Breakpoint Value Register 1 

DBGBCR1 EL1 RW |J- 32 C7.2 Debug Breakpoint Control Registers, EL1 


on page C7-610 





DBGWVRI1 EL1 


RW |J- 64 Debug Watchpoint Value Register 1 





DBGWCRI1 ELI 


RW |J- 32 C7.3 Debug Watchpoint Control Registers, EL1 
on page C7-613 




















MDCCINT_EL1 RW |@x00000000 32 Monitor Debug Comms Channel Interrupt Enable Register 
MDSCR_EL1 RW |J- 32 B2.82 Monitor Debug System Control Register, EL1 
on page B2-489 
DBGBVR2_EL1 RW |l- 64 Debug Breakpoint Value Register 2 
DBGBCR2 EL1 RW |J- 32 C7.2 Debug Breakpoint Control Registers, EL1 
on page C7-610 
DBGWVR2_ EL1 RW |J- 64 Debug Watchpoint Value Register 2 
DBGWCR2 EL1 RW |- 32 C7.3 Debug Watchpoint Control Registers, EL1 


on page C7-613 

















OSDTRTX_EL1 RW |J- 32 Debug Data Transfer Register, Transmit, External View 
DBGBVR3 _ EL] RW |l- 64 Debug Breakpoint Value Register 3 
DBGBCR3_EL1 RW |J- 32 C7.2 Debug Breakpoint Control Registers, EL1 
on page C7-610 
DBGWVR3_EL1 RW |- 64 Debug Watchpoint Value Register 3 
DBGWCR3_EL1 RW |- 32 C7.3 Debug Watchpoint Control Registers, EL1 


on page C7-613 





























DBGBVR4 ELI RW |l- 64 Debug Breakpoint Value Register 4 
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Table C7-1 AArch64 debug register summary (continued) 
























































Name Type | Reset Width | Description 
DBGBCR4 EL1 RW |- 32 C7.2 Debug Breakpoint Control Registers, EL1 
on page C7-610 
DBGBVRS_EL1 RW |J- 64 Debug Breakpoint Value Register 5 
DBGBCRS _EL1 RW |J- 32 C7.2 Debug Breakpoint Control Registers, EL1 
on page C7-610 

OSECCR_EL1 RW |J- 32 Debug OS Lock Exception Catch Register 
MDCCSR_ELO RO |l- 32 Monitor Debug Comms Channel Status Register 
DBGDTR_ELO RW |J- 64 Debug Data Transfer Register, half-duplex 
DBGDTRTX_ELO WO |- 32 Debug Data Transfer Register, Transmit, Internal View 
DBGDTRRX_ELO RO |J- 32 Debug Data Transfer Register, Receive, Internal View 
DBGVCR32_EL2 RW |l- 32 Debug Vector Catch Register 
MDRAR ELI RO [Resets to the physical 64 Debug ROM Address Register 

address of the ROM 

table +3. 
OSLAR EL1 WO |- 32 Debug OS Lock Access Register 
OSLSR_EL1 RO |@x0000000A 32 Debug OS Lock Status Register 
OSDLR_EL1 RW |@0x00000000 32 Debug OS Double Lock Register 
DBGPRCR_EL1 RW |J- 32 Debug Power/Reset Control Register 
DBGCLAIMSET_ EL1 RW | 0x@0Q000FF 32 Debug Claim Tag Set Register 
DBGCLAIMCLR EL1 RW | 0xeee00e00 32 Debug Claim Tag Clear Register 
DBGAUTHSTATUS EL1/RO_ |- 32 Debug Authentication Status Register 


























ARM 100236_0002_00_en 


Copyright © 2015-2017 ARM Limited or its affiliates. All rights 
reserved. 
Non-Confidential 


C7-609 


C7 AArch64 debug registers 
C7.2 Debug Breakpoint Control Registers, EL1 


C7.2 Debug Breakpoint Control Registers, EL1 
The DBGBCRn_ELIcharacteristics are: 


Purpose 
Holds control information for a breakpoint. Each DBGBVR_EL1 is associated with a 
DBGBCR_ ELI to form a Breakpoint Register Pair (BRP). DBGBVRn_ELI is associated with 
DBGBCRn_EL1 to form BRPn. 


The range ofn for DBGBCRa_ELI is 0 to 5. 


Usage constraints 
These registers are accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW |RW | RW | RW RW 


























Configurations 
DBGBCRv_EL] are architecturally mapped to: 
e The AArch32 DBGBCRaz registers. See C6.2 Debug Breakpoint Control Registers 
on page C6-596. 
¢ The external DBGBCRn_ELI registers. 


Attributes 
See C7.1 AArch64 debug register summary on page C7-608. 


The debug logic reset value of a DBGBCRu_EL1 is UNKNOWN. 


31 24 23 20 19 16 15 14 13 12 5 432 1 0 


Figure C7-1 DBGBCRn_EL1 


[31:24] 
Reserved, RESO. 

BT, [23:20] 
Breakpoint Type. This field controls the behavior of Breakpoint debug event generation. This 
includes the meaning of the value held in the associated DBGBVRn_ELI, indicating whether it 
is an instruction address match or mismatch or a Context match. It also controls whether the 
breakpoint is linked to another breakpoint. The possible values are: 





@beeee Unlinked instruction address match. 
@beee1 Linked instruction address match. 
@bee1@ Unlinked Context ID match. 

@be@e11 Linked Context ID match. 

@be1ee Unlinked instruction address mismatch. 
@b@101 Linked instruction address mismatch. 
@b10e0 Unlinked VMID match. 

@b1001 Linked VMID match. 

@b101@ Unlinked VMID + Context ID match. 


@b1011 Linked VMID + Context ID match. 


All other values are reserved. 
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The field break down is: 

e BTT[3:1]: Base type. If the breakpoint is not context-aware, these bits are Reso. Otherwise, the 
possible values are: 
@beee Match address. DBGBVRn_ EL] is the address of an instruction. 
@bee1 Match context ID. DBGBVRn_EL1[31:0] is a context ID. 


@be1e@ Address mismatch. Mismatch address. Behaves as type 0b000 if either: 
— In an AArch64 translation regime. 
— Halting debug-mode is enabled and halting is allowed. 


Otherwise, DBGBVRn_EL] is the address of an instruction to be stepped. 


b100 Match VMID. DBGBVRza_EL1[39:32] is a VMID. 


b101 Match VMID and context ID. DBGBVRn_EL1[31:0] is a context ID, and 
DBGBVRzv_EL1[39:32] is a VMID. 


e BT[O0]: Enable linking. 


LBN, [19:16] 


Linked breakpoint number. For Linked address matching breakpoints, this specifies the index of 
the Context-matching breakpoint linked to. 


SSC, [15:14] 


Security State Control. Determines the security states that a breakpoint debug event for 
breakpoint n is generated. 


This field must be interpreted with the Higher Mode Control (HMC), and Privileged Mode 
Control (PMC), fields to determine the mode and security states that can be tested. 


See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for 
possible values of the fields. 


HMC, [13] 


[12:9] 


Hyp Mode Control bit. Determines the debug perspective for deciding when a breakpoint debug 
event for breakpoint n is generated. 


This bit must be interpreted with the SSC and PMC fields to determine the mode and security 
states that can be tested. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for 
possible values of the fields. 


Reserved, RESO. 


BAS, [8:5] 


[4:3] 


Byte Address Select. Defines which half-words a regular breakpoint matches, regardless of the 
instruction set and execution state. A debugger must program this field as follows: 


0x3 Match the T32 instruction at DBGBVRn_EL1. 

@xC Match the T32 instruction at DBGBVRn+2_EL1. 

@xF Match the A64 or A32 instruction at DBGBVRn_ELI, or context match. 
All other values are reserved. 


The ARMv8-A architecture does not support direct execution of Java bytecodes. BAS[3] and 
BAS[1] ignore writes and on reads return the values of BAS[2] and BAS[0] respectively. 


See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for 
more information on how the BAS field is interpreted by hardware. 


Reserved, RESO. 
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PMC, [2:1] 


E, [0] 


Privileged Mode Control. Determines the exception level or levels that a breakpoint debug event 
for breakpoint n is generated. 


This field must be interpreted with the SSC and HMC fields to determine the mode and security 
states that can be tested. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for 
possible values of the fields. 


Bits[2:1] have no effect for accesses made in Hyp mode. 


Enable breakpoint. This bit enables the BRP: 

@ BRP disabled. 

1 BRP enabled. 

A BRP never generates a breakpoint debug event when it is disabled. 


The value of DBGBCRn_EL1.E is UNKNowNn on reset. A debugger must ensure that 
DBGBCRn_EL1.E has a defined value before it enables debug. 


To access the DBGBCRn_ELI in AArch64 Execution state, read or write the register with: 


MRS <Xt>, DBGBCRn_EL1; Read Debug Breakpoint Control Register n 
MSR DBGBCRn_EL1, <Xt>; Write Debug Breakpoint Control Register n 


To access the DBGBCRn_ELI in AArch32 Execution state, read or write the CP14 register with: 


MRC p14, ©, <Rt>, c0, cn, 4; Read Debug Breakpoint Control Register n 
MCR p14, ©, <Rt>, c@, cn, 4; Write Debug Breakpoint Control Register n 


The DBGBCRn_ELI can be accessed through the external debug interface, offset @x4n8. The range of 
bits for DBGBCRn_EL] is 0 to 5. 
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C7.3 Debug Watchpoint Control Registers, EL1 
The DBGWCRzv_ELIcharacteristics are: 


Purpose 
Holds control information for a watchpoint. Each DBGWCR_ EL] is associated with a 
DBGWVR _ ELI to form a Watchpoint Register Pair (WRP). DBGWCRn_ EL] is associated 
with DBGWVRn_EL]1 to form WRPn. 


The range ofn for DBGBCRu_EL1 is 0 to 3. 


Usage constraints 
These registers are accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- {RW [RW [RW [RW RW 


























Configurations 
The DBGWCRn_ EL] are architecturally mapped to: 
e The AArch32 DBGWCRz registers. 
e The external DBGWCRn_ELI registers. 


Attributes 
See C7.1 AArch64 debug register summary on page C7-608. 


The debug logic reset value of a DBGWCR_EL]1 is UNKNOWN. 


29 28 2423 212019 1615 14 13 12 54321 
L_wt L_HMC 


Figure C7-2 DBGWCR_EL1 

[31:29] 

Reserved, RESO. 
MASK, [28:24] 

Address mask. Only objects up to 2GB can be watched using a single mask. 

@beee8 No mask 

@beee1 Reserved 

@be@e10 Reserved 


Other values mask the corresponding number of address bits, from @b@0011 masking 3 address 
bits (@x@@000007 mask for address) to @b11111 masking 31 address bits (@x7FFFFFFF mask for 
address). 
[23:21] 
Reserved, RESO. 
WT, [20] 
Watchpoint type. Possible values are: 
(3 Unlinked data address match. 
1 Linked data address match. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
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LBN, [19:16] 
Linked breakpoint number. For Linked data address watchpoints, this specifies the index of the 
Context-matching breakpoint linked to. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


SSC, [15:14] 
Security state control. Determines the Security states under which a watchpoint debug event for 
watchpoint n is generated. This field must be interpreted along with the HMC and PAC fields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


HMC, [13] 
Higher mode control. Determines the debug perspective for deciding when a watchpoint debug 
event for watchpoint n is generated. This field must be interpreted along with the SSC and 
PACfields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


BAS, [12:5] 
Byte address select. Each bit of this field selects whether a byte from within the word or double- 
word addressed by DBGWVRn_ EL] is being watched. See the ARM® Architecture Reference 
Manual ARMV8, for ARMv8-A architecture profile for more information. 

LSC, [4:3] 
Load/store access control. This field enables watchpoint matching on the type of access being 
made. The possible values are: 
@b@1 Match instructions that load from a watchpointed address. 
@b1@ Match instructions that store to a watchpointed address. 


@b11 Match instructions that load from or store to a watchpointed address. 


All other values are reserved, but must behave as if the watchpoint is disabled. Software must 
not rely on this property as the behavior of reserved values might change in a future revision of 
the architecture. 


Ignored if E is 0. 
On Cold reset, the field reset value is architecturally UNKNOWN. 


PAG, [2:1] 
Privilege of access control. Determines the exception level or levels at which a watchpoint 
debug event for watchpoint n is generated. This field must be interpreted along with the SSC 
and HMCfields. 


On Cold reset, the field reset value is architecturally UNKNOWN. 


E, [0] 
Enable watchpoint n. Possible values are: 
(3 Watchpoint disabled. 
1 Watchpoint enabled. 


On Cold reset, the field reset value is architecturally UNKNOWN. 
To access the DBGWCRn_EL1: 


MRS <Xt>, DBGWCRn_EL1; Read Debug Watchpoint Control Register n 
MSR DBGWCRn_EL1, <Xt>; Write Debug Watchpoint Control Register n 


The DBGWCRzu_ELI can be accessed through the external debug interface, offset @x8n8. The range of n 
for DBGWCRn_EL1 is 0 to 3. 
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Chapter C8 
Memory-mapped debug registers 


This chapter describes the debug memory-mapped registers and shows examples of how to use them. 


It contains the following sections: 

e (C8.1 Memory-mapped debug register summary on page C8-616. 

e C8.2 External Debug Reserve Control Register on page C8-620. 

e C&8.3 External Debug Integration Mode Control Register on page C8-621. 

e C8.4 External Debug Device ID Register 0 on page C8-622. 

e C8.5 External Debug Device ID Register 1 on page C8-623. 

e C8.6 External Debug Processor Feature Register on page C8-624. 

e C8.7 External Debug Feature Register on page C8-626. 

e C8.8 External Debug Peripheral Identification Registers on page C8-628. 

e C8.9 External Debug Peripheral Identification Register 0 on page C8-629. 

e C8.10 External Debug Peripheral Identification Register 1 on page C8-630. 
e C811 External Debug Peripheral Identification Register 2 on page C8-631. 
e C8.12 External Debug Peripheral Identification Register 3 on page C8-632. 
e C8.13 External Debug Peripheral Identification Register 4 on page C8-633. 
e C8.14 External Debug Peripheral Identification Register 5-7 on page C8-634. 
e C8.15 External Debug Component Identification Registers on page C8-635. 
e (C8.16 External Debug Component Identification Register 0 on page C8-636. 
e C8.17 External Debug Component Identification Register 1 on page C8-637. 
e C818 External Debug Component Identification Register 2 on page C8-638. 
e C8.19 External Debug Component Identification Register 3 on page C8-639. 
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C8 Memory-mapped debug registers 
C8.1 Memory-mapped debug register summary 




























































































C8.1 Memory-mapped debug register summary 
The following table shows the offset address for the registers that are accessible from the external debug 
interface. 
For those registers not described in this chapter, see the ARM® Architecture Reference Manual ARMV8, 
for ARMv8-A architecture profile. 
Table C8-1 Memory-mapped debug register summary 
Offset Name Type | Width | Description 
@x@00-OxO1C | - - Reserved 
0x020 EDESR RW |32 External Debug Event Status Register 
0x024 EDECR RW |32 External Debug Execution Control Register 
0x028-0x02C | - - - Reserved 
0x030 EDWAR[31:0] RO |64 External Debug Watchpoint Address Register 
0x034 EDWAR[63:32] 
0x038 -0x07C | - - - Reserved 
0x080 DBGDTRRX_ELO RW | 32 Debug Data Transfer Register, Receive 
0x084 EDITR WO |32 External Debug Instruction Transfer Register 
0x088 EDSCR RW |32 External Debug Status and Control Register 
@x@8C DBGDTRTX_ELO RW | 32 Debug Data Transfer Register, Transmit 
0x090 EDRCR WO |32 C8.2 External Debug Reserve Control Register on page C8-620 
0x094 EDACR RW |32 External Debug Auxiliary Control Register 
0x098 EDECCR RW |32 External Debug Exception Catch Control Register 
@xe@9C - - 32 Reserved 
Ox0AQ EDPCSRlo RO |32 External Debug Program Counter Sample Register, low word 
Ox0A4 EDCIDSR RO [|32 External Debug Context ID Sample Register 
OxX0A8 EDVIDSR RO [|32 External Debug Virtual Context Sample Register 
OxOAC EDPCSRhi RO [|32 External Debug Program Counter Sample Register, high word 
@x@BO-Ox2FC | - - - Reserved 
0x300 OSLAR_EL1 WO |32 OS Lock Access Register 
0x304-0x30C | - - - Reserved 
0x310 EDPRCR RW |32 External Debug Power/Reset Control Register 
0x314 EDPRSR RO |32 External Debug Processor Status Register 
0x318-0x3FC | - - -- Reserved 
0x400 DBGBVRO0_EL1[31:0] RW |64 Debug Breakpoint Value Register 0 
0x404 DBGBVRO_EL1[63:32] 
0x408 DBGBCRO_EL1 RW |32 C7.2 Debug Breakpoint Control Registers, EL] on page C7-610 
@x40C - - - Reserved 
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C8 Memory-mapped debug registers 
C8.1 Memory-mapped debug register summary 


Table C8-1 Memory-mapped debug register summary (continued) 

















































































































Offset Name Type | Width | Description 

0x410 DBGBVR1_EL1[31:0] RW |64 Debug Breakpoint Value Register 1 

0x414 DBGBVR1_EL1[63:32] 

0x418 DBGBCR1_EL1 RW |32 C7.2 Debug Breakpoint Control Registers, EL1 on page C7-610 
@x41C - - - Reserved 

0x420 DBGBVR2_EL1[31:0] RW |64 Debug Breakpoint Value Register 2 

0x424 DBGBVR2_EL1[63:32] 

0x428 DBGBCR2_EL1 RW |32 C7.2 Debug Breakpoint Control Registers, EL1 on page C7-610 
@x42C - - - Reserved 

0x430 DBGBVR3_EL1[31:0] RW |64 Debug Breakpoint Value Register 3 

0x434 DBGBVR3_EL1[63:32] 

0x438 DBGBCR3_EL1 RW |32 C7.2 Debug Breakpoint Control Registers, EL1 on page C7-610 
@x43C - - - Reserved 

0x440 DBGBVR4_EL1[31:0] RW |64 Debug Breakpoint Value Register 4 

0x444 DBGBVR4_EL1[63:32] 

0x448 DBGBCR4 EL1 RW | 32 C7.2 Debug Breakpoint Control Registers, EL] on page C7-610 
@x44C - - - Reserved 

0x450 DBGBVR5_EL1[31:0] RW |64 Debug Breakpoint Value Register 5 

0x454 DBGBVR5_EL1[63:32] 

0x458 DBGBCR5_EL1 RW |32 C7.2 Debug Breakpoint Control Registers, EL1 on page C7-610 
@x45C-Ox7FC | - - - Reserved 

0x800 DBGWVRO_EL1[31:0] RW | 64 Debug Watchpoint Value Register 0 

0x804 DBGWVRO_EL1[63:32] 

0x808 DBGWCRO_EL1 RW | 32 C7.3 Debug Watchpoint Control Registers, ELI on page C7-613 
@x80C - - - Reserved 

0x810 DBGWVR1_EL1[31:0] RW |64 Debug Watchpoint Value Register 1 

0x814 DBGWVR1_EL1[63:32] 

0x818 DBGWCRI1 ELI RW | 32 C7.3 Debug Watchpoint Control Registers, EL] on page C7-613 
@x81C - - - Reserved 

0x820 DBGWVR2_EL1[31:0] RW |64 Debug Watchpoint Value Register 2 

0x824 DBGWVR2_EL1[63:32] 

0x828 DBGWCR2_EL1 RW |32 C7.3 Debug Watchpoint Control Registers, EL] on page C7-613 
@x82C - - - Reserved 

0x830 DBGWVR3_EL1[31:0] RW |64 Debug Watchpoint Value Register 0, 

0x834 DBGWVR3_EL1[63:32] 

0x838 DBGWCR3_EL1 RW |32 C7.3 Debug Watchpoint Control Registers, EL] on page C7-613 
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C8 Memory-mapped debug registers 
C8.1 Memory-mapped debug register summary 


Table C8-1 Memory-mapped debug register summary (continued) 











































































































Offset Name Type | Width | Description 

@x83C-@xCFC | - - - Reserved 

@xDee MIDR_EL1 RO | 32 B2.83 Main ID Register, ELI on page B2-492 

@xD@4-@xD1C | - - - Reserved 

@xD290 EDPFR[31:0] RO | 64 C8.6 External Debug Processor Feature Register on page C8-624 

@xD24 EDPFR[63:32] 

@xD28 EDDFR[31:0] RO | 64 C8.7 External Debug Feature Register on page C8-626 

@xD2C EDDFR[63:32] 

@xD30-0xD34 |- - - Reserved 

@xD38-OxD3C |- - - Reserved 

@xD60-OxEFC | - - - Reserved 

OxFeO EDITCTRL RW | 32 C8.3 External Debug Integration Mode Control Register 
on page C8-621 

@xF@4-OxF9C | - - - Reserved 

OxFA@ DBGCLAIMSET _ EL1 RW | 32 Debug ClaimTag Set register 

@xFA4 DBGCLAIMCLR EL1 RW | 32 Debug Claim Tag Clear Register 

OxFA8 EDDEVAFFO RO |32 B2.84 Multiprocessor Affinity Register, EL1 on page B2-494 

@xFAC EDDEVAFF1 RO |32 B2.84 Multiprocessor Affinity Register, EL1 on page B2-494 

OxFB@ EDLAR WO | 32 External Debug Lock Access Register 

OxFB4 EDLSR RO | 32 External Debug Lock Status Register 

@xFB8 DBGAUTHSTATUS EL1}RO [|32 Debug Authentication Status Register 

@xFBC EDDEVARCH RO | 32 External Debug Device Architecture Register 

@xFCO EDDEVID2 RO |32 External Debug Device ID Register 2, RESO 

@xFC4 EDDEVID1 RO |32 C8.5 External Debug Device ID Register 1 on page C8-623 

OxFC8 EDDEVID RO |32 C8.4 External Debug Device ID Register 0 on page C8-622 

@xFCC EDDEVTY PE RO | 32 External Debug Device Type Register 

@xFDO EDPIDR4 RO | 32 C8.13 External Debug Peripheral Identification Register 4 
on page C8-633 

@xFD4-@xFDC | EDPIDRS-7 RO |32 C8.14 External Debug Peripheral Identification Register 5-7 
on page C8-634 

@xFE@ EDPIDRO RO |32 C8.9 External Debug Peripheral Identification Register 0 
on page C8-629 

OxFE4 EDPIDR1 RO | 32 C8.10 External Debug Peripheral Identification Register 1 
on page C8-630 

OxFE8 EDPIDR2 RO | 32 C8.11 External Debug Peripheral Identification Register 2 
on page C8-631 

@xFEC EDPIDR3 RO |32 C8.12 External Debug Peripheral Identification Register 3 


on page C8-632 
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C8 Memory-mapped debug registers 
C8.1 Memory-mapped debug register summary 


Table C8-1 Memory-mapped debug register summary (continued) 




















Offset Name Type | Width | Description 

OxFFO EDCIDRO RO | 32 C8.16 External Debug Component Identification Register 0 
on page C8-636 

OxFF4 EDCIDR1 RO | 32 C8.17 External Debug Component Identification Register 1 
on page C8-637 

OxFF8 EDCIDR2 RO | 32 C8.18 External Debug Component Identification Register 2 
on page C8-638 

@xFFC EDCIDR3 RO | 32 C8.19 External Debug Component Identification Register 3 
on page C8-639 
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C8 Memory-mapped debug registers 
C8.2 External Debug Reserve Control Register 


C8.2 External Debug Reserve Control Register 
The EDRCR characteristics are: 


Purpose 
This register is used to allow imprecise entry to Debug state and clear sticky bits in EDSCR. 


This register is part of the Debug registers functional group. 


Usage constraints 
This register is accessible as follows: 





Off | DLK | OSLK | SLK | Default 




















Error | Error | Error | WI | WO 





Configurations 
EDRCR is in the Core power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


EDRCR is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16.15 14 13 1211 10 9 8 76543210 


CBRRQ— 
CSPA 
CSE 


Figure C8-1 EDRCR bit assignments 


[31:5] 
Reserved, RESO. 

CBRRQ, [4] 
Allow imprecise entry to Debug state. The actions on writing to this bit are: 
(3 No action. 


1 Allow imprecise entry to Debug state, for example by canceling pending bus accesses. 
Setting this bit to 1 allows a debugger to request imprecise entry to Debug state. An 
External Debug Request debug event must be pending before the debugger sets this bit 
to 1. 


CSPA, [3] 
Clear Sticky Pipeline Advance. This bit is used to clear the EDSCR.PipeAdv bit to 0. The 
actions on writing to this bit are: 
(3 No action. 
1 Clear the EDSCR.PipeAdv bit to 0. 
CSE, [2] 


Clear Sticky Error. Used to clear the EDSCR cumulative error bits to 0. The actions on writing 
to this bit are: 


(2) No action 
1 Clear the EDSCR. {TXU, RXO, ERR} bits, and, if the processor is in Debug state, the 
EDSCR.ITO bit, to 0. 


[1:0] 
Reserved, RESO. 


The EDRCR can be accessed through the external debug interface, offset 0x090. 
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C8.3 External Debug Integration Mode Control Register 
The EDITCTRL characteristics are: 


Purpose 
Enables the external debug to switch from its default mode into integration mode, where test 
software can control directly the inputs and outputs of the processor, for integration testing or 
topology detection. 

Usage constraints 
This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 




















- - - - RO | RW 





Table C1-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
EDITCTRL is in the processor power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 
31 1 0 
md 
IME— 


Figure C8-2 EDITCTRL bit assignments 


[31:1] 
Reserved, RESO. 
IME, [0] 
Integration Mode Enable. 
RESO. The device does not revert to an integration mode to enable integration testing or 
topology detection. 


The EDITCTRL can be accessed through the external debug interface, offset @xFee. 
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C8.4 External Debug Device ID Register 0 


External Debug Device ID Register 0 


The EDDEVID characteristics are: 


Purpose 

Provides extra information for external debuggers about features of the debug implementation. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
s: iis: jie i - [RO 























Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDDEVID is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 28 27 24 23 4 3 0 


Figure C8-3 EDDEVID bit assignments 


[31:28] 
Reserved, RESO. 
AuxRegs, [27:24] 
Indicates support for Auxiliary registers: 


@xe None supported. 
[23:4] 
Reserved, RESO. 


PC Sample, [3:0] 
Indicates the level of sample-based profiling support using external debug registers 40 to 43: 


0x3 EDPCSR, EDCIDSR, and EDVIDSR are implemented. 


The EDDEVID can be accessed through the external debug interface, offset @xFC8. 
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C8.5 External Debug Device ID Register 1 


C8.5 External Debug Device ID Register 1 
The EDDEVID1 characteristics are: 


Purpose 

Provides extra information for external debuggers about features of the debug implementation. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





i - [RO 




















Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDDEVID1 is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 4 3 0 


Figure C8-4 EDDEVID1 bit assignments 


[31:4] 
Reserved, RESO. 
PCSROffset, [3:0] 
Indicates the offset applied to PC samples returned by reads of EDPCSR: 
@x2 EDPCSR samples have no offset applied and do not sample the instruction set state in 
AArch32 state. 


The EDDEVID1 can be accessed through the external debug interface, offset @xFC4. 
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C8.6 External Debug Processor Feature Register 
The EDPFR characteristics are: 


Purpose 

Provides additional information about implemented PE features in AArch64. 
Usage constraints 

This register is accessible as follows: 


Default 





RO 


Configurations 
The EDPFR is: 
e Architecturally mapped to the AArch64 ID_AA64PFRO EL] register. See B2.54 AArch64 
Processor Feature Register 0, ELI on page B2-437. 
e EDPFR is in the Debug power domain. 


Attributes 
EDPFR is a 64-bit register. 


28 27 |, 24 23 2019,, 1615 ,, 12 11 


Ce Teh 


Figure C8-5 EDPFR bit assignments 


[63:28] 
Reserved, RESO. 
GIC, [27:24] 
System register GIC interface. Defined values are: 


exe No System register interface to the GIC is supported. 
0x1 System register interface to the GIC CPU interface is supported. 


All other values are reserved. 


AdvSIMD, [23:20] 
Advanced SIMD. Defined values are: 


@xe Advanced SIMD is implemented. 
@xF Advanced SIMD is not implemented. 


All other values are reserved. 


FP, [19:16] 
Floating-point. Defined values are: 


exe Floating-point is implemented. 
@xF Floating-point is not implemented. 


All other values are reserved. 


EL3 handling, [15:12] 
EL3 exception handling: 


0x2 Instructions can be executed at EL3 in AArch64 or AArch32 state. 


EL2 handling, [11:8] 
EL2 exception handling: 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights C8-624 
reserved. 
Non-Confidential 
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C8.6 External Debug Processor Feature Register 


0x2 Instructions can be executed at EL2 in AArch64 or AArch32 state. 


EL1 handling, [7:4] 
EL1 exception handling. The possible values are: 


0x2 Instructions can be executed at EL1 in AArch64 or AArch32 state. 


ELO handling, [3:0] 
ELO exception handling. The possible values are: 


0x2 Instructions can be executed at ELO in AArch64 or AArch32 state. 
The EDPFR[31:0] can be accessed through the external debug interface, offset @xD20. 
The EDPFR[63:32] can be accessed through the external debug interface, offset @xD24. 
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C8.7 External Debug Feature Register 
The EDDFR characteristics are: 


Purpose 

Provides top level information about the debug system in AArch64. 
Usage constraints 

This register is accessible as follows: 


Default 
RO 





Configurations 
External register EDDFR is architecturally mapped to the AArch64 ID _AA64DFRO_EL1 
register. See B2.5] AArch64 Debug Feature Register 0, ELI on page B2-431. 


EDDFR is in the Debug power domain. 


Attributes 
EDDFR is a 64-bit register. 


63 32:31 28 27 24 23 20:19 1615 12 11 





Figure C8-6 EDDFR bit assignments 


[63:32] 
Reserved, RESO. 
CTX_CMPs, [31:28] 
Number of breakpoints that are context-aware, minus 1. These are the highest numbered 
breakpoints. 
[27:24] 
Reserved, RESO. 
WRPs, [23:20] 
Number of watchpoints, minus 1. The value of @b@@@@ is reserved. 
[19:16] 
Reserved, RESO. 
BRPs, [15:12] 
Number of breakpoints, minus 1. The value of @b@@@ is reserved. 
PMUVer, [11:8] 
Performance Monitors extension version. Indicates whether system register interface to 
Performance Monitors extension is implemented. Defined values are: 


@xeeee Performance Monitors extension system registers not implemented. 
@x@001 Performance Monitors extension system registers implemented, PMUVv3. 


@x1111 IMPLEMENTATION DEFINED form of performance monitors supported, PMUv3 not 
1 supported. 
All other values are reserved. 


TraceVer [7:4] 
Trace support. Indicates whether system register interface to a trace macrocell is implemented. 
Defined values are: 


@xeeee Trace macrocell system registers not implemented. 
@x@ee1 Trace macrocell system registers implemented. 


All other values are reserved. 
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A value of @x@@@@ only indicates that no system register interface to a trace macrocell is 
implemented. A trace macrocell might nevertheless be implemented without a system register 
interface. 


UNKOWN, [7:4] 
Reserved, UNKNOWN. 


EDDFR{[31:0] can be accessed through the external debug interface, offset @xD28. 


EDDFR[63:32] can be accessed through the external debug interface, offset @xD2C. 
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C8.8 External Debug Peripheral Identification Registers 


The External Debug Peripheral Identification Registers provide standard information required for all 
components that conform to the ARM Debug Interface v5 specification. 


The following table lists the External Debug Peripheral Identification Registers. 


Table C8-2 Summary of the External Debug Peripheral Identification Registers 





Register Value | Offset 





Peripheral ID4 | 0x04 | @xFD@ 





Peripheral ID5 | 0x00 | OxFD4 





Peripheral ID6 | 0x00 | OxFD8 





Peripheral ID7 | 0x00 | @xFDC 





Peripheral IDO | 0x24 | OxFE@ 





Peripheral ID1 | @xBD | @xFE4 





Peripheral ID2 | @x2B | O@xFE8 





Peripheral ID3 | 0x00 | @xFEC 

















Only bits[7:0] of each Peripheral ID Register are used, with bits[3 1:8] reserved. Together, the eight 
Peripheral ID Registers define a single 64-bit Peripheral ID. 
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C8.9 External Debug Peripheral Identification Register 0 
The EDPIDRO characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
i - [RO 























Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDPIDRO is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 8 7 0 


Figure C8-7 EDPIDRO bit assignments 


[31:8] 
Reserved, RESO. 
Part_0, [7:0] 


0x04 Least significant byte of the debug part number. 


The EDPIDRO can be accessed through the external debug interface, offset @xFE@. 
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External Debug Peripheral Identification Register 1 


The EDPIDR1 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
- RO 























Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDPIDR1 is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 8 7 4 3 0 


Figure C8-8 EDPIDR1 bit assignments 


[31:8] 
Reserved, RESO. 
DES_0, [7:4] 


@xB ARM Limited. This is the least significant nibble of JEP106 ID code. 


Part_1, [3:0] 
@xD Most significant nibble of the debug part number. 


The EDPIDRI can be accessed through the external debug interface, offset @xFE4. 
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C8.11 External Debug Peripheral Identification Register 2 
The EDPIDR2 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





i - [RO 




















Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDPIDR2 is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 8 7 4 3 2 0 


JEDEC — 
Figure C8-9 EDPIDR2 bit assignments 


[31:8] 
Reserved, RESO. 
Revision, [7:4] 


@x2 r0p2. 


JEDEC, [3] 
@b1 RAO. Indicates a JEP 106 identity code is used. 


DES_1, [2:0] 
@be11 ARM Limited. This is the most significant nibble of JEP106 ID code. 


The EDPIDR2 can be accessed through the external debug interface, offset @xFE8. 
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External Debug Peripheral Identification Register 3 


The EDPIDR3 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
- RO 























Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDPIDR3 is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 8 7 4 3 0 


Figure C8-10 EDPIDR3 bit assignments 


[31:8] 
Reserved, RESO. 
REVAND, [7:4] 


0x0 Part minor revision. 
CMOD, [3:0] 
0x0 Customer modified. 


The EDPIDR3 can be accessed through the external debug interface, offset @xFEC. 
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External Debug Peripheral Identification Register 4 


The EDPIDR4 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
- RO 























Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDPIDR4 is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 8 7 4 3 0 


Figure C8-11 EDPIDR4 bit assignments 


[31:8] 
Reserved, RESO. 
Size, [7:4] 


@x@ Size of the component. Log, the number of 4KB pages from the start of the component to 
the end of the component ID registers. 


DES _2, [3:0] 
e@x4 ARM Limited. This is the least significant nibble JEP 106 continuation code. 


The EDPIDR4 can be accessed through the external debug interface, offset @xFD@. 
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C8 Memory-mapped debug registers 
C8.14 External Debug Peripheral Identification Register 5-7 


C8.14 External Debug Peripheral Identification Register 5-7 
No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. 


They are reserved for future use and are RESO. 
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C8 Memory-mapped debug registers 
C8.15 External Debug Component Identification Registers 


C8.15 External Debug Component Identification Registers 


There are four read-only External Debug Component Identification Registers, Component IDO through 


Component ID3. 


Table C8-3 Summary of the External Debug Component Identification Registers 





Register 


Value 


Offset 





Component IDO 


@x@D 


OxFFO 





Component ID1 


8x90 


OxFF4 





Component [D2 


0x05 


OxFF8 





Component ID3 











@xB1 





OxFFC 





The External Debug Component Identification Registers identify Debug as an ARM Debug Interface v5 


component. 
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C8 Memory-mapped debug registers 
C8.16 External Debug Component Identification Register 0 


C8.16 External Debug Component Identification Register 0 
The EDCIDRO characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
i - [RO 























Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDCIDRO is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 8 7 0 


Figure C8-12 EDCIDRO bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 0, [7:0] 


@x@D Preamble byte 0. 


The EDCIDRO can be accessed through the external debug interface, offset @xFF@. 
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C8 Memory-mapped debug registers 
C8.17 External Debug Component Identification Register 1 


External Debug Component Identification Register 1 


The EDCIDR1 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





- - RO 




















Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDCIDR1 is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 8 7 4 3 0 


Figure C8-13 EDCIDR1 bit assignments 


[31:8] 
Reserved, RESO. 
CLASS, [7:4] 


@x9 Debug component. 


PRMBL 1, [3:0] 
@xe Preamble. 


The EDCIDRI can be accessed through the external debug interface, offset @xFF4. 
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C8 Memory-mapped debug registers 
C8.18 External Debug Component Identification Register 2 


C8.18 External Debug Component Identification Register 2 
The EDCIDR2 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
i - [RO 























Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDCIDR2 is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 8 7 0 


Figure C8-14 EDCIDR2 bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 2, [7:0] 


0x05 Preamble byte 2. 


The EDCIDR2 can be accessed through the external debug interface, offset @xFF8. 
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C8 Memory-mapped debug registers 
C8.19 External Debug Component Identification Register 3 


C8.19 External Debug Component Identification Register 3 
The EDCIDR3 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
i - [RO 























Table Cl-1 Conditions on external register access to debug registers on page C1-553 describes 
the condition codes. 


Configurations 
The EDCIDR3 is in the Debug power domain. 
Attributes 
See C8. 1 Memory-mapped debug register summary on page C8-616. 


31 8 7 0 


Figure C8-15 EDCIDR3 bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 3, [7:0] 


@xB1 Preamble byte 3. 


The EDCIDR3 can be accessed through the external debug interface, offset @xFFC. 
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C8 Memory-mapped debug registers 
C8.19 External Debug Component Identification Register 3 
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Chapter C9 
ROM table 


This chapter describes the ROM table that debuggers can use to determine which components are 
implemented. It also describes the ROM table registers. 


It contains the following sections: 

e (C9.1 About the ROM table on page C9-642. 

e C9.2 ROM table register interface on page C9-643. 

e C9.3 ROM table register summary on page C9-644. 

e (C9.4 ROM entry registers on page C9-645. 

e C9.5 ROM Table Peripheral Identification Registers on page C9-648. 

e C9.6 ROM Table Peripheral Identification Register 0 on page C9-649. 

e C9.7 ROM Table Peripheral Identification Register 1 on page C9-650. 

e C9.8 ROM Table Peripheral Identification Register 2 on page C9-651. 

e C9.9 ROM Table Peripheral Identification Register 3 on page C9-652. 

e C9.10 ROM Table Peripheral Identification Register 4 on page C9-653. 
e C9.1] ROM Table Peripheral Identification Register 5-7 on page C9-654. 
e C9.12 ROM Table Component Identification Registers on page C9-655. 
e C9.13 ROM Table Component Identification Register 0 on page C9-656. 
¢« C9.14 ROM Table Component Identification Register 1 on page C9-657. 
e C9.15 ROM Table Component Identification Register 2 on page C9-658. 
e C9.16 ROM Table Component Identification Register 3 on page C9-659. 
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C9 ROM table 
C9.1 About the ROM table 


C9.1 About the ROM table 
The processor includes a ROM table that complies with the ARM CoreSight Architecture Specification. 


This table contains a list of components such as processor debug units, processor Cross Trigger 
Interfaces (CTIs), processor Performance Monitoring Units (PMUs), and processor Embedded Trace 
Macrocell (ETM) trace units. Debuggers can use the ROM table to determine which components are 
implemented inside the Cortex-A35 processor. 


If a component is not included in your configuration of the Cortex-A35 processor, the corresponding 
debug APB ROM table entry is still present but the component is marked as not present. 
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C9 ROM table 
C9.2 ROM table register interface 


C9.2 ROM table register interface 
The interface to the ROM table entries is the APB slave port. 


See C1.2 Debug access on page C1-551. 
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C9 ROM table 
C9.3 ROM table register summary 


C9.3 ROM table register summary 
The following table shows the offsets from the physical base address of the ROM table. 


Table C9-1 ROM table registers 


























































































































Offset Name Type | Description 

0x000 ROMENTRYO |RO |C9.4 ROM entry registers on page C9-645 

0x004 ROMENTRY1 |RO 

0x008 ROMENTRY2 |RO 

@x@OC ROMENTRY3 | RO 

0x010 ROMENTRY4 |RO 

0x014 ROMENTRY5 |RO 

0x018 ROMENTRY6 |RO 

@x01C ROMENTRY7 | RO 

0x020 ROMENTRY8 |RO 

0x024 ROMENTRY9 |RO 

0x028 ROMENTRY 10 | RO 

@xO2C ROMENTRY11 | RO 

0x030 ROMENTRY 12 | RO 

0x034 ROMENTRY13 | RO 

0x038 ROMENTRY 14 | RO 

@x@3C ROMENTRY 15 | RO 

@x040-OxFCC | - RO _ | Reserved, RESO 

@xFDO ROMPIDR4 RO | C9.10 ROM Table Peripheral Identification Register 4 on page C9-653 

@xFD4 ROMPIDRS RO | C9.11 ROM Table Peripheral Identification Register 5-7 on page C9-654 

@xFD8 ROMPIDR6 RO 

@xFDC ROMPIDR7 RO 

@xFEQ ROMPIDRO RO | C9.6 ROM Table Peripheral Identification Register 0 on page C9-649 

@xFE4 ROMPIDR1 RO | C9.7 ROM Table Peripheral Identification Register 1 on page C9-650 

OxFE8 ROMPIDR2 RO | C9.8 ROM Table Peripheral Identification Register 2 on page C9-651 

OxFEC ROMPIDR3 RO | C9.9 ROM Table Peripheral Identification Register 3 on page C9-652 

OxFFO ROMCIDRO RO | C9.13 ROM Table Component Identification Register 0 on page C9-656 

OxFF4 ROMCIDR1 RO | C9.14 ROM Table Component Identification Register 1 on page C9-657 

OxFF8 ROMCIDR2 RO | C9.15 ROM Table Component Identification Register 2 on page C9-658 

@xFFC ROMCIDR3 RO | C9.16 ROM Table Component Identification Register 3 on page C9-659 
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C9 ROM table 
C9.4 ROM entry registers 


C9.4 ROM entry registers 
The characteristics of the ROMENTRY7 are: 


Purpose 
Indicates to a debugger whether the debug component is present in the debug logic of the 
processor. There are 16 ROMENTRY registers in the Cortex-A35 processor. 

Usage constraints 
These registers are accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





a fle le le ws TRO 




















C1.4 External access permissions to debug registers on page C1-553 describes the condition 
codes. 


Configurations 

There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes 

See C9.3 ROM table register summary on page C9-644. 


31 12 11 2 1 0 


Format —! 
Component present 
Figure C9-1 ROMENTRY bit assignments 


Address offset, [31:12] 
Address offset for the debug component. 


Negative values of address offsets are permitted using the two’s complement of the offset. 


[11:2] 
Reserved, RESO. 

Format, [1] 
Format of the ROM table entry. The value for all ROMENTRY registers is: 
() End marker. 


1 32-bit format. 
Component present, [0] 
Indicates whether the component is present: 


(3 Component is not present. 
1 Component is present. 


The debug, CTI, and PMU components for core 0 are always present. 


The Physical Address of a debug component is determined by shifting the address offset 12 places to the 
left and adding the result to the Physical Address of the Cortex-A35 processor ROM table. 


The following tables show the offset values for all ROMENTRY values when a v8 memory map is 
implemented and the offset values for all ROMENTRY values when a legacy v7 memory map is 
implemented. 


If a core is not implemented, the ROMENTRY registers for its debug, CTI, PMU, and ETM trace unit 
components are 0x00000000 when a v8 memory map is implemented and @x@@000002 when a v7 
memory map is implemented. 
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C9 ROM table 
C9.4 ROM entry registers 


If a core is implemented but the ETM trace unit is not implemented then the corresponding ROMENTRY 
register is @x@0000@02 in both the v7 and v8 memory maps. 


Table C9-2 v8 ROMENTRY values 













































































Name Debug component | Address offset [31:12] | ROMENTRY value 
ROMENTRY0 | Core 0 Debug 0x00010 0x00010003 
ROMENTRY1 | Core 0 CTI 0x00020 0x00020003 
ROMENTRY2 | Core 0 PMU 90x00030 0x00030003 
ROMENTRY3 | Core 0 ETM 0x00040 0x00040003 

If the component is present. 
ROMENTRY4 |Core 1 Debug 0x00110 0x00110003 

If the component is present. 
ROMENTRY5 | Core 1 CTI 0x00120 0x00120003 

If the component is present. 
ROMENTRY6 | Core 1 PMU 0x00130 0x00130003 

If the component is present. 
ROMENTRY7 | Core 1 ETM 0x00140 0x00140003 

If the component is present. 
ROMENTRY8 | Core 2 Debug 0x00210 0x00210003 

If the component is present. 
ROMENTRY9 | Core 2 CTI @x00220 0x00220003 

If the component is present. 
ROMENTRY 10 | Core 2 PMU @x00230 0x00230003 

If the component is present. 
ROMENTRY 11 | Core 2 ETM @x00240 0x00240003 

If the component is present. 
ROMENTRY 12 | Core 3 Debug 0x00310 0x00310003 

If the component is present. 
ROMENTRY 13 | Core 3 CTI 0x00320 0x00320003 

If the component is present. 
ROMENTRY 14 | Core 3 PMU 0x00330 0x00330003 

If the component is present. 
ROMENTRY 15 | Core 3 ETM 0x00340 0x00340003 

















If the component is present. 
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C9 ROM table 
C9.4 ROM entry registers 


Table C9-3 Legacy v7 ROMENTRY values 










































































Name Debug component | Address offset [31:12] | ROMENTRY value 
ROMENTRY0 | Core 0 Debug 0x00010 0x00010003 
ROMENTRY!1 | Core 0 PMU 0x00011 0x00011003 
ROMENTRY2 | Core 1 Debug 0x00012 0x00012003 
ROMENTRY3 |Core 1 PMU 0x00013 0x00013003 

If the component is present. 
ROMENTRY4 | Core 2 Debug 0x00014 0x00014003 

If the component is present. 
ROMENTRY5 | Core 2 PMU 0x00015 0x00015003 

If the component is present. 
ROMENTRY6 | Core 3 Debug @x00016 0x00016003 

If the component is present. 
ROMENTRY7 | Core 3 PMU 0x00017 0x00017003 

If the component is present. 
ROMENTRY8 | Core 0 CTI 0x00018 0x00018003 

If the component is present. 
ROMENTRY9 | Core 1 CTI 0x00019 0x00019003 

If the component is present. 
ROMENTRY 10 | Core 2 CTI 0x0001A 0x0001A003 

If the component is present. 
ROMENTRY!11 | Core 3 CTI @x0001B 0x0001B003 

If the component is present. 
ROMENTRY 12 | Core 0 ETM @x@001C 0x0001C003 

If the component is present. 
ROMENTRY 13 | Core 1 ETM @x@001D 0x0001D003 

If the component is present. 
ROMENTRY 14 | Core 2 ETM 0x0001E 0x0001E003 

If the component is present. 
ROMENTRY 15 | Core 3 ETM 0x0001F 0x0001F003 























If the component is present. 
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C9.5 ROM Table Peripheral Identification Registers 


C9 ROM table 
C9.5 ROM Table Peripheral Identification Registers 


The ROM Table Peripheral Identification Registers provide standard information required for all 
components that conform to the ARM Debug Interface Architecture Specification, ADIv5.0 to ADIvS.2. 


There are eight registers listed in register number order in the following table. 


Table C9-4 Summary of the ROM Table Peripheral Identification Registers 









































Register | Value Offset 
ROMPIDR4 | 0x04 OxFD@ 
ROMPIDRS | 0x00 @xFD4 
ROMPIDR6 | 0x00 OxFD8 
ROMPIDR7 | 0x00 @xFDC 
ROMPIDRO | @xAA for v8 memory map. | @xFE@ 
@xE®@ for v7 memory map. 
ROMPIDRI | @xB4 OxFE4 
ROMPIDR2 | @x2B OxFE8 
ROMPIDR3 | 0x00 OxFEC 











Only bits[7:0] of each Peripheral ID Register are used, with bits[3 1:8] reserved. Together, the eight 


Peripheral ID Registers define a single 64-bit Peripheral ID. 
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C9 ROM table 
C9.6 ROM Table Peripheral Identification Register 0 


ROM Table Peripheral Identification Register 0 


The ROMPIDRO characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





wy: lie. jte ‘lar fe. RO 




















C1.4 External access permissions to debug registers on page C1-553 describes the condition 
codes. 


Configurations 

The ROMPIDRO is in the Debug power domain. 
Attributes 

See C9.3 ROM table register summary on page C9-644. 


31 8 7 0 


Figure C9-2 ROMPIDRO bit assignments 


[31:8] 
Reserved, RESO. 

Part_0, [7:0] 
Least significant byte of the ROM table part number. 
@xAA For v8 memory map. 


@xE@ For v7 memory map. 


The ROMPIDRO can be accessed through the external debug interface, offset @xFE®. 
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C9 ROM table 
C9.7 ROM Table Peripheral Identification Register 1 


C9.7 ROM Table Peripheral Identification Register 1 
The ROMPIDRI characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
- RO 























C1.4 External access permissions to debug registers on page C1-553 describes the condition 
codes. 


Configurations 

The ROMPIDR1 is in the Debug power domain. 
Attributes 

See C9.3 ROM table register summary on page C9-644. 


31 8 7 4 3 0 


Figure C9-3 ROMPIDR1 bit assignments 


[31:8] 
Reserved, RESO. 
DES_0, [7:4] 


xB Least significant nibble of JEP 106 ID code. For ARM Limited. 


Part_1, [3:0] 
@x4 Most significant nibble of the ROM table part number. 


The ROMPIDRI can be accessed through the external debug interface, offset @xFE4. 
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C9 ROM table 
C9.8 ROM Table Peripheral Identification Register 2 


C9.8 ROM Table Peripheral Identification Register 2 
The ROMPIDR2 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





i - [RO 




















C1.4 External access permissions to debug registers on page C1-553 describes the condition 


codes. 
Configurations 
The ROMPIDR2 is in the Debug power domain. 
Attributes 
See C9.3 ROM table register summary on page C9-644. 
31 8 7 4:3 2 0 
| reson | | es 


JEDEC — 
Figure C9-4 ROMPIDR2 bit assignments 


[31:8] 
Reserved, RESO. 
Revision, [7:4] 


@x2 r0p2. 


JEDEC, [3] 
@b1 RAO. Indicates a JEP 106 identity code is used. 


DES _1, [2:0] 
@be11 Designer, most significant bits of JEP106 ID code. For ARM Limited. 


The ROMPIDR2 can be accessed through the external debug interface, offset @xFE8. 
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C9 ROM table 
C9.9 ROM Table Peripheral Identification Register 3 


ROM Table Peripheral Identification Register 3 


The ROMPIDR3 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
- RO 























C1.4 External access permissions to debug registers on page C1-553 describes the condition 
codes. 


Configurations 

The ROMPIDR3 is in the Debug power domain. 
Attributes 

See C9.3 ROM table register summary on page C9-644. 


31 8 7 4 3 0 


Figure C9-5 ROMPIDR3 bit assignments 


[31:8] 
Reserved, RESO. 
REVAND, [7:4] 


0x0 Part minor revision. 
CMOD, [3:0] 
0x0 Customer modified. 


The ROMPIDR3 can be accessed through the external debug interface, offset @xFEC. 
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C9 ROM table 
C9.10 ROM Table Peripheral Identification Register 4 


C9.10 ROM Table Peripheral Identification Register 4 
The ROMPIDR4 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
- RO 























C1.4 External access permissions to debug registers on page C1-553 describes the condition 
codes. 


Configurations 

The ROMPIDR4 is in the Debug power domain. 
Attributes 

See C9.3 ROM table register summary on page C9-644. 


31 8 7 4 3 0 


Figure C9-6 ROMPIDR4 bit assignments 


[31:8] 
Reserved, RESO. 
Size, [7:4] 


@x@ Size of the component. Log2 the number of 4KB pages from the start of the component to 
the end of the component ID registers. 


DES 2, [3:0] 
0x4 Designer, JEP 106 continuation code, least significant nibble. For ARM Limited. 


The ROMPIDR4 can be accessed through the external debug interface, offset @xFD@. 
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C9 ROM table 
C9.11 ROM Table Peripheral Identification Register 5-7 


C9.11 ROM Table Peripheral Identification Register 5-7 
No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. 


They are reserved for future use and are RESO. 
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C9.12 ROM Table Component Identification Registers 


C9 ROM table 
C9.12 ROM Table Component Identification Registers 


There are four read-only ROM Table Component Identification Registers, Component IDO through 


Component ID3. 


Table C9-5 Summary of the ROM table component Identification registers 





Register 


Value 


Offset 





ROMCIDRO 


@x@D 


OxFFO 





ROMCIDR1 


8x10 


OxFF4 





ROMCIDR2 


0x05 


OxFF8 





ROMCIDR3 








@xB1 





OxFFC 








The ROM Table Component Identification Registers identify Debug as an ARM Debug Interface v5 


component. 
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C9 ROM table 
C9.13 ROM Table Component Identification Register 0 


C9.13 ROM Table Component Identification Register 0 
The ROMCIDRO characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





i - [RO 




















C1.4 External access permissions to debug registers on page C1-553 describes the condition 
codes. 


Configurations 

The ROMCIDRO is in the Debug power domain. 
Attributes 

See C9.3 ROM table register summary on page C9-644. 


31 8 7 0 


Figure C9-7 ROMCIDRO bit assignments 


[31:8] 
Reserved, RESO. 
Size, [7:0] 


@x@D Preamble byte 0. 


The ROMCIDRO can be accessed through the external debug interface, offset @xFF@. 
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C9 ROM table 
C9.14 ROM Table Component Identification Register 1 


C9.14 ROM Table Component Identification Register 1 
The ROMCIDRI characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





i - [RO 




















C1.4 External access permissions to debug registers on page C1-553 describes the condition 
codes. 


Configurations 

The ROMCIDR1 is in the Debug power domain. 
Attributes 

See C9.3 ROM table register summary on page C9-644. 


31 8 7 4 3 0 


Figure C9-8 ROMCIDR1 bit assignments 


[31:8] 
Reserved, RESO. 
CLASS, [7:4] 


0x1 Component Class. For a ROM table. 


PRMBL 1, [3:0] 
@xe Preamble. 


The ROMCIDRI can be accessed through the external debug interface, offset @xFF4. 
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C9 ROM table 
C9.15 ROM Table Component Identification Register 2 


C9.15 ROM Table Component Identification Register 2 
The ROMCIDR2 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
- - RO 























C1.4 External access permissions to debug registers on page C1-553 describes the condition 
codes. 


Configurations 

The ROMCIDR2 is in the Debug power domain. 
Attributes 

See C9.3 ROM table register summary on page C9-644. 


31 8 7 0 


Figure C9-9 ROMCIDR2 bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 2, [7:0] 


0x05 Preamble byte 2. 


The ROMCIDR2 can be accessed through the external debug interface, offset @xFF8. 
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C9 ROM table 
C9.16 ROM Table Component Identification Register 3 


C9.16 ROM Table Component Identification Register 3 
The ROMCIDR3 characteristics are: 


Purpose 

Provides information to identify an external debug component. 
Usage constraints 

This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 
- - RO 























C1.4 External access permissions to debug registers on page C1-553 describes the condition 
codes. 


Configurations 

The ROMCIDR3 is in the Debug power domain. 
Attributes 

See C9.3 ROM table register summary on page C9-644. 


31 8 7 0 


Figure C9-10 ROMCIDR3 bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 3, [7:0] 


@xB1 Preamble byte 3. 


The ROMCIDR3 can be accessed through the external debug interface, offset @xFFC. 
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C9 ROM table 
C9.16 ROM Table Component Identification Register 3 
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Chapter C10 
PMU registers 


This chapter describes the PMU registers. 


It contains the following sections: 

e (C10.1 AArch32 PMU register summary on page C10-662. 

e (C10.2 Performance Monitors Control Register on page C10-664. 

e (C10.3 Performance Monitors Common Event Identification Register 0 on page C10-667. 
¢ (10.4 Performance Monitors Common Event Identification Register 1 on page C10-671. 
e (C10.5 AArch64 PMU register summary on page C10-673. 

e (C10.6 Performance Monitors Control Register, ELO on page C10-674. 

e C10.7 Performance Monitors Common Event Identification Register 0, ELO on page C10-677. 
e C10.8 Performance Monitors Common Event Identification Register 1, ELO on page C10-681. 
e C10.9 Memory-mapped PMU register summary on page C10-683. 

e (C10.10 Performance Monitors Configuration Register on page C10-686. 

e (C10.11 Performance Monitors Peripheral Identification Registers on page C10-687. 

e (C10.12 Performance Monitors Peripheral Identification Register 0 on page C10-688. 

e (C10.13 Performance Monitors Peripheral Identification Register 1 on page C10-689. 

e (10.14 Performance Monitors Peripheral Identification Register 2 on page C10-690. 

e C10.15 Performance Monitors Peripheral Identification Register 3 on page C10-691. 

e (10.16 Performance Monitors Peripheral Identification Register 4 on page C10-692. 

e (C10.17 Performance Monitors Peripheral Identification Register 5-7 on page C10-693. 
e (C10.18 Performance Monitors Component Identification Registers on page C10-694. 

e C10.19 Performance Monitors Component Identification Register 0 on page C10-695. 

e C10.20 Performance Monitors Component Identification Register 1 on page C10-696. 

e C10.21 Performance Monitors Component Identification Register 2 on page C10-697. 

e C10.22 Performance Monitors Component Identification Register 3 on page C10-698. 
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C10 PMU registers 
C10.1 AArch32 PMU register summary 


C10.1 AArch32 PMU register summary 


The PMU counters and their associated control registers are accessible in the AArch32 Execution state 
from the internal CP15 system register interface with MCR and MRC instructions for 32-bit registers and 
MCRR and MRRC for 64-bit registers. 


The following table gives a summary of the Cortex-A35 PMU registers in the AArch32 Execution state. 
For those registers not described in this chapter, see the ARM” Architecture Reference Manual ARMVvé8, 
for ARMv8-A architecture profile. 


See the C/0.9 Memory-mapped PMU register summary on page C10-683 for a complete list of registers 
that are accessible from the external debug interface. 


Table C10-1 PMU register summary in the AArch32 Execution state 





























CRn | Op1 | CRm | Op2 | Name Type | Width | Description 

c9 0 cl2 JO PMCR RW |32 C10.2 Performance Monitors Control Register on page C10-664 

c9 0 cl2 jl PMCNTENSET |RW_ [|32 Performance Monitors Count Enable Set Register 

c9 0 cl2 |2 PMCNTENCLR |RW_ [|32 Performance Monitors Count Enable Clear Register 

c9 0 cl2 |3 PMOVSR RW |32 Performance Monitors Overflow Flag Status Register 

c9 0 cl2 |4 PMSWINC WO |32 Performance Monitors Software Increment Register 

c9 0 cl2 |5 PMSELR RW |32 Performance Monitors Event Counter Selection Register 

c9 0 cl2 |6 PMCEIDO RO |32 C10.3 Performance Monitors Common Event Identification Register 0 


on page C10-667 





c9 0 cl2 |7 PMCEID1 RO |32 C10.4 Performance Monitors Common Event Identification Register 1 
on page C10-671 





c9 0 c13 |0 MCCNTR[31:0] |} RW | 32 Performance Monitors Cycle Count Register 





MCCNTR[63:0] RW | 64 





c9 0 cl3 |} 1 MXEVTYPER |RW_ [|32 Performance Monitors Selected Event Type Register 





MCCFILTR RW |32 Performance Monitors Cycle Count Filter Register 





c9 0 c13 |2 MXEVCNTR [RW [|32 Performance Monitors Selected Event Count Register 





c9 0 cl4 JO MUSERENR RW |32 Performance Monitors User Enable Register 





c9 0 cl4 jl MINTENSET |RW_ [|32 Performance Monitors Interrupt Enable Set Register 








c9 0 cl4 |3 MOVSSET RW |32 Performance Monitor Overflow Flag Status Set Register 








cl4 |0 c8 0 MEVCNTRO RW | 32 Performance Monitor Event Count Registers 





cl4 |0 c8 1 MEVCNTRI RW |32 





cl4 |0 c8 2 MEVCNTR2 RW |32 





cl4 |0 c8 3 MEVCNTR3 RW |32 





cl4 |0 c8 4 MEVCNTR4 RW |32 








P 
P 
P 
P 
P 
P 
P 
c9 0 cl4 |2 PMINTENCLR |RW_ [|32 Performance Monitors Interrupt Enable Clear Register 
P 
P 
P 
P 
P 
P 
P 








cl4 |0 c8 5 MEVCNTRS RW |32 
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C10 PMU registers 


C10.1 AArch32 PMU register summary 


Table C10-1 PMU register summary in the AArch32 Execution state (continued) 





















































CRn | Op1 | CRm | Op2 | Name Type | Width | Description 

cl4 |0 c12 JO PMEVTYPERO |RW_ [|32 Performance Monitors Event Type Registers 

cl4 |0 cl2 |1 PMEVTYPERI IRW [|32 

cl4 |0 cl2 |2 PMEVTYPER2 IRW [|32 

cl4 |0 cl2 |3 PMEVTYPER3 IRW [|32 

cl4 |0 cl2 |4 PMEVTYPER4 IRW [|32 

cl4 |0 c12 |5 PMEVTYPERS IRW [|32 

cl4 |0 cl5 |7 PMCCFILTR RW |32 Performance Monitors Cycle Count Filter Register 
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C10 PMU registers 
C10.2 Performance Monitors Control Register 


C10.2 Performance Monitors Control Register 
The PMCR characteristics are: 


Purpose 
Provides details of the Performance Monitors implementation, including the number of counters 
implemented, and configures and controls the counters. 

Usage constraints 
This register is accessible as follows: 











ELO (ELO |EL1 |EL1 |EL2 |EL3 EL3 
(NS) |(S) (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
Config | Config | RW |RW |RW | RW RW 


























This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1. 


Configurations 
PMCR is architecturally mapped to AArch64 PMCR_ELO register. See C/0.6 Performance 
Monitors Control Register, ELO on page C10-674. 


PMCR[6:0] is architecturally mapped to external PMCR_ELO register. 
There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
PMCR is a 32-bit register. 


24 23 16 15 11 10 7654321 





Figure C10-1 PMCR bit assignments 


IMP, [31:24] 
Implementer code: 


0x41 ARM. 


This is a read-only field. 
IDCODE, [23:16] 


Identification code: 


@x@A Cortex-A35. 


This is a read-only field. 


N, [15:11] 
Number of event counters. 


0b00110 Six counters. 


[10:7] 
Reserved, RESO. 

LC, [6] 
Long cycle count enable. Determines which PMCCNTR bit generates an overflow recorded in 
PMOVSRJ31]. The possible values are: 





(2) Overflow on increment that changes PMCCNTR[31] from 1 to 0. 
1 Overflow on increment that changes PMCCNTR[63] from | to 0. 
DP, [5] 
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X, [4] 


D, [3] 


C, [2] 


P, [1] 


E, [0] 


C10 PMU registers 
C10.2 Performance Monitors Control Register 


Disable cycle counter, PMCCNTR when event counting is prohibited: 


(3 Cycle counter operates regardless of the non-invasive debug authentication 
settings. This is the reset value. 

1 Cycle counter is disabled if non-invasive debug is not permitted and enabled. 

This bit is read/write. 


Export enable. This bit permits events to be exported to another debug device, such as a trace 
macrocell, over an event bus: 


(3 Export of events is disabled. This is the reset value. 
1 Export of events is enabled. 
This bit is read/write and does not affect the generation of Performance Monitors interrupts on 


the nPMUIRQ pin. 


Clock divider: 


(3 When enabled, PMCCNTR counts every clock cycle. This is the reset value. 
1 When enabled, PMCCNTR counts every 64 clock cycles. 


This bit is read/write. 


Clock counter reset. This bit is WO. The effects of writing to this bit are: 


(7) No action. This is the reset value. 
1 Reset PMCCNTR_ELO to 0. 
This bit is always RAZ. 


Resetting PMCCNTR does not clear the PMCCNTR overflow bit to 0. See the ARM® 
Architecture Reference Manual ARMV8, for ARMvS8-A architecture profile for more information. 


Event counter reset. This bit is WO. The effects of writing to this bit are: 


@ No action. This is the reset value. 
1 Reset all event counters, not including PMCCNTR, to zero. 
This bit is always RAZ. 


In Non-secure ELO and EL1, a write of 1 to this bit does not reset event counters that 
HDCR.HPMN reserves for EL2 use. 


In EL2 and EL3, a write of 1 to this bit resets all the event counters. 


Resetting the event counters does not clear any overflow bits to 0. 


Enable. The possible values of this bit are: 


(2) All counters, including PMCCNTR, are disabled. This is the reset value. 
1 All counters are enabled. 
This bit is RW. 


In Non-secure ELO and EL1, this bit does not affect the operation of event counters that 
HDCR_EL2.HPMN reserves for EL2 use. 


On Warm reset, the field resets to 0. 
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C10 PMU registers 
C10.2 Performance Monitors Control Register 


To access the PMCR: 


MRC p15, 4, <Rt>, c12, c@, © ; Read PMCR into Rt 
MCR p15, 4, <Rt>, c12, c0, © ; Write Rt to PMCR 


The PMCR can be accessed through the external debug interface, offset @xE04. 
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C10 PMU registers 
C10.3 Performance Monitors Common Event Identification Register 0 


C10.3 Performance Monitors Common Event Identification Register 0 
The PMCEID0 characteristics are: 


Purpose 
Defines which common architectural and common microarchitectural feature events are 
implemented. 

Usage constraints 
This register is accessible as follows: 








ELO (ELO /|EL1 |EL1|EL2|EL3 EL3 
(NS) | (S) (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
Config | Config | RO |RO |RO |RO RO 





























This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1. 


Configurations 
The PMCEID0 is architecturally mapped to: 
e The AArch64 register PMCEIDO_ELO. See C/0.7 Performance Monitors Common Event 
Identification Register 0, ELO on page C10-677. 
e The external register PMCEIDO_ELO. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
PMCEID0 is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16.15 14 13 1211109 8 76543210 


Figure C10-2 PMCEIDO bit assignments 


CE[31:0], [31:0] 
Common architectural and microarchitectural feature events that can be counted by the PMU 
event counters. 


The following table shows the PMCEID0 bit assignments with event implemented or not 
implemented when the associated bit is set to 1 or 0. See the ARM® Architecture Reference 
Manual ARMV8, for ARMv8-A architecture profile for more information about these events. 


Table C10-2 PMU events 



































Bit | Event number | Event mnemonic Description 

[31] | @x1F L1D_CACHE ALLOCATE L1 Data cache allocate: 

(2 This event is not implemented. 

[30] | @x1E CHAIN Chain. For odd-numbered counters, counts once for each overflow of the 
preceding even-numbered counter. For even-numbered counters, does not 
count: 

1 This event is implemented. 
[29] | @x1D BUS CYCLES Bus cycle: 
1 This event is implemented. 
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C10 PMU registers 
C10.3 Performance Monitors Common Event Identification Register 0 


Table C10-2 PMU events (continued) 





















































Bit | Event number | Event mnemonic Description 
[28] | @x1C TTBR_WRITE_ RETIRED TTBR write, architecturally executed, condition check pass - write to 
translation table base: 
(2 This event is not implemented. 
[27] | 0x1B INST_SPEC Instruction speculatively executed: 
1 This event is implemented. 
[26] | @x1A MEMORY ERROR Local memory error: 
1 This event is implemented. 
[25] | 0x19 BUS ACCESS Bus access: 
1 This event is implemented. 
[24] | 0x18 L2D_ CACHE WB L2 Data cache Write-Back: 
(2 This event is not implemented if the Cortex-A35 processor has 
been configured without an L2 cache. 
1 This event is implemented if the Cortex-A35 processor has been 
configured with an L2 cache. 
[23] | 0x17 L2D_CACHE_REFILL L2 Data cache refill: 
(2 This event is not implemented if the Cortex-A35 processor has 
been configured without an L2 cache. 
1 This event is implemented if the Cortex-A35 processor has been 
configured with an L2 cache. 
[22] | 0x16 L2D_CACHE L2 Data cache access: 
(2 This event is not implemented if the Cortex-A35 processor has 
been configured without an L2 cache. 
1 This event is implemented if the Cortex-A35 processor has been 
configured with an L2 cache. 
[21] | 0x15 LID_CACHE_WB L1 Data cache Write-Back: 
1 This event is implemented. 
[20] | 0x14 L1I CACHE L1 Instruction cache access: 
1 This event is implemented. 
[19] | 0x13 MEM _ ACCESS Data memory access: 
1 This event is implemented. 
[18] | 0x12 BR_PRED Predictable branch speculatively executed: 
1 This event is implemented. 
[17] | 0x11 CPU_CYCLES Cycle: 
1 This event is implemented. 
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C10 PMU registers 
C10.3 Performance Monitors Common Event Identification Register 0 


Table C10-2 PMU events (continued) 





Bit 


Event number 


Event mnemonic 


Description 





[16] 


0x10 


BR_MIS_ PRED 


Mispredicted or not predicted branch speculatively executed: 


1 This event is implemented. 





[15] 


OxOF 


UNALIGNED_LDST_RETIRED 


Instruction architecturally executed, condition check pass - unaligned load 
or store: 


1 This event is implemented. 





[14] 


Ox@E 


BR_RETURN_ RETIRED 


Instruction architecturally executed, condition check pass - procedure 
return: 


(2 This event is not implemented. 





[13] 


@x@D 


BR_IMMED RETIRED 


Instruction architecturally executed - immediate branch: 


1 This event is implemented. 





[12] 


@x@C 


PC_WRITE RETIRED 


Instruction architecturally executed, condition check pass - software 
change of the PC: 


1 This event is implemented. 





[11] 


@x@B 


CID_WRITE_ RETIRED 


Instruction architecturally executed, condition check pass - write to 
CONTEXTIDR: 


1 This event is implemented. 





[10] 


Ox8A 


EXC_RETURN 


Instruction architecturally executed, condition check pass - exception 
return: 


1 This event is implemented. 





[9] 


0x09 


EXC_TAKEN 


Exception taken: 


1 This event is implemented. 





[8] 


0x08 


INST_RETIRED 


Instruction architecturally executed: 


1 This event is implemented. 








[7] 


0x07 


ST_RETIRED 


Instruction architecturally executed, condition check pass - store: 


1 This event is implemented. 








[6] 


0x06 


LD_RETIRED 


Instruction architecturally executed, condition check pass - load: 


1 This event is implemented. 








[5] 


0x05 


L1D_TLB_REFILL 


L1 Data TLB refill: 


1 This event is implemented. 





[4] 


0x04 


L1D_CACHE 


L1 Data cache access: 


1 This event is implemented. 





[3] 








0x03 





L1ID_CACHE_ REFILL 





L1 Data cache refill: 


1 This event is implemented. 
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C10 PMU registers 
C10.3 Performance Monitors Common Event Identification Register 0 


Table C10-2 PMU events (continued) 
































Bit | Event number | Event mnemonic Description 

[2] | exe2 L1I TLB_REFILL L1 Instruction TLB refill: 
1 This event is implemented. 

[1] | 0x01 L1I CACHE REFILL L1 Instruction cache refill: 
1 This event is implemented. 

[0] | 0x00 SW_INCR Instruction architecturally executed, condition check pass - software 
increment: 
1 This event is implemented. 

To access the PMCEIDO: 


MRC p15,0,<Rt>,c9,c12,6 ; Read PMCEID@ into Rt 


The PMCEID0 can be accessed through the external debug interface, offset @xE20. 
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C10 PMU registers 
C10.4 Performance Monitors Common Event Identification Register 1 










































































C10.4 Performance Monitors Common Event Identification Register 1 
The PMCEID1 characteristics are: 
Purpose 
Defines which common architectural and common microarchitectural feature events are 
implemented. 
Usage constraints 
This register is accessible as follows: 
ELO |ELO /|EL1 |EL1/EL2/EL3 EL3 
(NS) |(S) (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
Config | Config | RO |RO |RO |RO RO 
This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1 
Configurations 
The PMCEID1 is architecturally mapped to: 
e The AArch64 register PMCEID1 ELO. See C/0.8 Performance Monitors Common Event 
Identification Register 1, ELO on page C10-681. 
e The external register PMCEID1_ ELO. 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes 
PMCEID1 is a 32-bit register. 
31 17:16 0 
Figure C10-3 PMCEID1 bit assignments 
[31:17] 
CE[48:32], [16:0] 
Common architectural and microarchitectural feature events that can be counted by the PMU 
event counters. 
For each bit described in The following table, the event is implemented if the bit is set to 1, or 
not implemented if the bit is set to 0. 
Table C10-3 PMU common events 
Bit | Event number | Event mnemonic Description 
[16] | 0x30 L2I TLB Attributable Level 2 instruction TLB access. 
(2 This event is not implemented. 
[15] | @x2F L2D_TLB Attributable Level 2 data or unified TLB access. 
(2 This event is not implemented. 
[14] | 0x2E L2I TLB_REFILL Attributable Level 2 instruction TLB refill. 
(2 This event is not implemented. 
[13] | @x2D L2D_TLB_REFIL Attributable Level 2 data or unified TLB refill. 
7) This event is not implemented. 
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C10 PMU registers 
C10.4 Performance Monitors Common Event Identification Register 1 


Table C10-3 PMU common events (continued) 













































































Bit | Event number | Event mnemonic Description 
[12] | @x2C L3D_CACHE_WB Attributable Level 3 data or unified cache write-back. 
(2 This event is not implemented. 
[11] | 0x2B L3D_ CACHE Attributable Level 3 data or unified cache access. 
(2 This event is not implemented. 
[10] | @x2A L3D_CACHE_REFILL Attributable Level 3 data or unified cache refill. 
(2 This event is not implemented. 
[9] | 0x29 L3D_CACHE_ALLOCATE | Attributable Level 3 data or unified cache allocation without refill. 
(2 This event is not implemented. 
[8] | 0x28 L2I CACHE REFILL Attributable Level 2 instruction cache refill. 
2) This event is not implemented. 
[7] | @x27 L2I CACHE Attributable Level 2 instruction cache access. 
(2 This event is not implemented. 
[6] | 0x26 L1I TLB Level 1 instruction TLB access. 
(2 This event is not implemented. 
[5] | 0x25 LID TLB Level 1 data or unified TLB access. 
(2 This event is not implemented. 
[4] | 0x24 STALL_BACKEND No operation issued due to backend. 
(2 This event is not implemented. 
[3] | 0x23 STALL_FRONTEND No operation issued due to the frontend. 
(2 This event is not implemented. 
[2] | 0x22 BR_MIS_PRED_RETIRED | Instruction architecturally executed, mispredicted branch. 
(2 This event is not implemented. 
[1] |0x21 BR_RETIRED Instruction architecturally executed, branch. 
(2 This event is not implemented. 
[0] | 0x20 L2D_CACHE_ALLOCATE | Level 2 data cache allocation without refill. 
(2 This event is not implemented. 








To access the PMCEID1: 


MRC p15,0,<Rt>,c9,c12,7 ; Read PMCEID1 into Rt 


The PMCEID1 can be accessed through the external debug interface, offset @xE24. 
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C10 PMU registers 


C10.5 AArch64 PMU register summary 








































































































C10.5 AArch64 PMU register summary 
The PMU counters and their associated control registers are accessible in the AArch64 Execution state 
with MRS and MSR instructions. 
The following table gives a summary of the Cortex-A35 PMU registers in the AArch64 Execution state. 
For those registers not described in this chapter, see the ARM" Architecture Reference Manual ARMV6, 
for ARMv8-A architecture profile. 
Table C10-4 PMU register summary in the AArch64 Execution state 

Name Type | Width | Description 

PMCR_ELO RW | 32 C10.6 Performance Monitors Control Register, ELO on page C10-674 

PMCNTENSET ELO |RW | 32 Performance Monitors Count Enable Set Register 

PMCNTENCLR_ELO|RW_ | 32 Performance Monitors Count Enable Clear Register 

PMOVSCLR_ELO RW | 32 Performance Monitors Overflow Flag Status Register 

PMSWINC_ELO WO | 32 Performance Monitors Software Increment Register 

PMSELR_ELO RW |32 Performance Monitors Event Counter Selection Register 

PMCEIDO_ ELO RO | 32 C10.7 Performance Monitors Common Event Identification Register 0, ELO on page C10-677 

PMCEID1_ ELO RO | 32 C10.8 Performance Monitors Common Event Identification Register 1, ELO on page C10-681 

PMCCNTR_ELO RW | 64 Performance Monitors Cycle Count Register 

PMXEVTYPER ELO | RW | 32 Performance Monitors Selected Event Type and Filter Register 

PMCCFILTR_ELO RW | 32 Performance Monitors Cycle Count Filter Register 

PMXEVCNTRO_ELO|RW_ | 32 Performance Monitors Selected Event Count Register 

PMUSERENR ELO |RW_ |32 Performance Monitors User Enable Register 

PMINTENSET EL1 |RW_ [|32 Performance Monitors Interrupt Enable Set Register 

PMINTENCLR EL1 |RW |32 Performance Monitors Interrupt Enable Clear Register 

PMOVSSET_ELO RW | 32 Performance Monitors Overflow Flag Status Set Register 

PMEVCNTRO ELO |RW_ [|32 Performance Monitors Event Count Registers 

PMEVCNTRI_ELO |RW_ | 32 

PMEVCNTR2 ELO |RW | 32 

PMEVCNTR3_ELO |RW | 32 

PMEVCNTR4 ELO |RW | 32 

PMEVCNTRS5 ELO |RW | 32 

PMEVTYPERO ELO |RW_ | 32 Performance Monitors Event Type Registers 

PMEVTYPERI ELO |RW | 32 

PMXVTYPER2 ELO |RW | 32 

PMEVTYPER3 ELO |RW_ | 32 

PMEVTYPER4 ELO |RW | 32 

PMEVTYPERS ELO |RW | 32 

PMCCFILTR_ELO RW | 32 Performance Monitors Cycle Count Filter Register 
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C10 PMU registers 
C10.6 Performance Monitors Control Register, ELO 


C10.6 Performance Monitors Control Register, ELO 
The PMCR_ELO characteristics are: 


Purpose 
Provides details of the Performance Monitors implementation, including the number of counters 
implemented, and configures and controls the counters. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
RW |RW | RW [RW [RW RW 


























This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1. 


Configurations 
PMCR_ELO is architecturally mapped to the AArch32 PMCR register. See C/0.2 Performance 
Monitors Control Register on page C10-664. 


PMCR[6:0] is architecturally mapped to external PMCR_ELDO register. 


Attributes 
PMCR_ELO is a 32-bit register. 


24 23 16 15 11 10 76543210 





Figure C10-4 PMCR_ELO bit assignments 


IMP, [31:24] 
Implementer code: 


0x41 ARM. 


This is a read-only field. 


IDCODE, [23:16] 
Identification code: 


OXxXOA Cortex-A35. 


This is a read-only field. 


N, [15:11] 
Number of event counters. 


@bee110 Six counters. 


[10:7] 
Reserved, RESO. 
LC, [6] 
Long cycle count enable. Determines which PMCCNTR_ELO bit generates an overflow 
recorded in PMOVSR[31]. The possible values are: 
(3 Overflow on increment that changes PMCCNTR_ELO[31] from 1 to 0. 


1 Overflow on increment that changes PMCCNTR_ELO[63] from 1 to 0. 


DP, [5] 
Disable cycle counter, PMCCNTR_ELO when event counting is prohibited: 
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X, [4] 


D, [3] 


C, [2] 


P, [1] 


E, [0] 


C10 PMU registers 
C10.6 Performance Monitors Control Register, ELO 


(3 Cycle counter operates regardless of the non-invasive debug authentication 
settings. This is the reset value. 


1 Cycle counter is disabled if non-invasive debug is not permitted and enabled. 


This bit is read/write. 


Export enable. This bit permits events to be exported to another debug device, such as a trace 
macrocell, over an event bus: 


(3 Export of events is disabled. This is the reset value. 


1 Export of events is enabled. 


This bit is read/write and does not affect the generation of Performance Monitors interrupts on 
the nPMUIRQ pin. 


Clock divider: 

(3 When enabled, PMCCNTR_ELO counts every clock cycle. This is the reset 
value. 

1 When enabled, PMCCNTR_ELO counts every 64 clock cycles. 


This bit is read/write. 


Clock counter reset. This bit is WO. The effects of writing to this bit are: 


e No action. This is the reset value. 
1 Reset PMCCNTR_ELO to 0. 
This bit is always RAZ. 


Resetting PMCCNTR_ELO does not clear the PMCCNTR_ELO overflow bit to 0. See the ARM” 
Architecture Reference Manual ARMVv8, for ARMvS8-A architecture profile for more information. 


Event counter reset. This bit is WO. The effects of writing to this bit are: 


(3 No action. This is the reset value. 
1 Reset all event counters, not including PMCCNTR_ELO, to zero. 
This bit is always RAZ. 


In Non-secure ELO and EL1, a write of 1 to this bit does not reset event counters that 
MDCR_EL2.HPMN reserves for EL2 use. 


In EL2 and EL3, a write of 1 to this bit resets all the event counters. 


Resetting the event counters does not clear any overflow bits to 0. 


Enable. The possible values of this bit are: 


(3 All counters, including PMCCNTR_ELO, are disabled. This is the reset value. 
1 All counters are enabled. 
This bit is RW. 


In Non-secure ELO and EL1, this bit does not affect the operation of event counters that 
MDCR_EL2.HPMN reserves for EL2 use. 


On Warm reset, the field resets to 0. 
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C10 PMU registers 
C10.6 Performance Monitors Control Register, ELO 


To access the PMCR_ELO: 


MRS <Xt>, PMCR_EL@ ; Read PMCR_EL® into Xt 
MSR PMCR_EL@, <Xt> ; Write Xt to PMCR_EL® 


To access the PMCR in AArch32 Execution state, read or write the CP15 registers with: 


MRC p15, @, <Rt>, c9, c12, @; Read Performance Monitor Control Register 
MCR p15, ©, <Rt>, c9, c12, 0; Write Performance Monitor Control Register 


The PMCR_ELO can be accessed through the external debug interface, offset @xEe4. 
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C10.7 Performance Monitors Common Event Identification Register 0, ELO 
The PMCEIDO_ELO characteristics are: 


Purpose 
Defines which common architectural and common microarchitectural feature events are 
implemented. 

Usage constraints 
This register is accessible as follows: 




















ELO |EL1 |EL1/EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
Config| RO |RO |RO |RO RO 














This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1. 


Configurations 
The PMCEID0_ELO is architecturally mapped to: 
e The AArch32 register PMCEIDO. See C/0.3 Performance Monitors Common Event 
Identification Register 0 on page C10-667. 
¢ The external register PMCEIDO_ELO. 


Attributes 
PMCEID0_ELO is a 32-bit register. 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16.15 14 13 1211109 8 76543 210 


Figure C10-5 PMCEIDO_ELO bit assignments 


CE[31:0], [31:0] 
Common architectural and microarchitectural feature events that can be counted by the PMU 
event counters. 


For each bit described in the following table, the event is implemented if the bit is set to 1, or 
not implemented if the bit is set to 0. 


Table C10-5 PMU common events 






































Bit | Event number | Event mnemonic Description 

[31] | @x1F L1D_CACHE_ ALLOCATE L1 Data cache allocate: 

(2 This event is not implemented. 

[30] | @x1E CHAIN Chain. For odd-numbered counters, counts once for each overflow of the 
preceding even-numbered counter. For even-numbered counters, does not 
count: 

1 This event is implemented. 

[29] | @x1D BUS CYCLES Bus cycle: 

1 This event is implemented. 

[28] | @x1C TTBR_WRITE_ RETIRED TTBR write, architecturally executed, condition check pass - write to 
translation table base: 

(2 This event is not implemented. 
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C10 PMU registers 
C10.7 Performance Monitors Common Event Identification Register 0, ELO 


Table C10-5 PMU common events (continued) 

































































Bit | Event number | Event mnemonic Description 
[27] | @x1B INST_SPEC Instruction speculatively executed: 
1 This event is implemented. 
[26] | @x1A MEMORY ERROR Local memory error: 
1 This event is implemented. 
[25] | 0x19 BUS_ACCESS Bus access: 
1 This event is implemented. 
[24] | 0x18 L2D_CACHE_WB L2 Data cache Write-Back: 
[3] This event is not implemented if the Cortex-A35 processor has 
been configured without an L2 cache. 
1 This event is implemented if the Cortex-A35 processor has 
been configured with an L2 cache. 
[23] | 0x17 L2D_CACHE_REFILL L2 Data cache refill: 
(2 This event is not implemented if the Cortex-A35 processor has 
been configured without an L2 cache. 
1 This event is implemented if the Cortex-A35 processor has 
been configured with an L2 cache. 
[22] | 0x16 L2D_CACHE L2 Data cache access: 
(2 This event is not implemented if the Cortex-A35 processor has 
been configured without an L2 cache. 
1 This event is implemented if the Cortex-A35 processor has 
been configured with an L2 cache. 
[21] | 0x15 LID_CACHE_WB L1 Data cache Write-Back: 
1 This event is implemented. 
[20] | 0x14 LiL CACHE L1 Instruction cache access: 
1 This event is implemented. 
[19] | 0x13 MEM _ ACCESS Data memory access: 
1 This event is implemented. 
[18] | 0x12 BR_PRED Predictable branch speculatively executed: 
1 This event is implemented. 
[17] | 0x11 CPU_CYCLES Cycle: 
1 This event is implemented. 
[16] | 9x10 BR_MIS_ PRED Mispredicted or not predicted branch speculatively executed: 
1 This event is implemented. 
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C10 PMU registers 
C10.7 Performance Monitors Common Event Identification Register 0, ELO 


Table C10-5 PMU common events (continued) 





Bit 


Event number 


Event mnemonic 


Description 





[15] 


OxOF 


UNALIGNED_ LDST_RETIRED 


Instruction architecturally executed, condition check pass - unaligned load 
or store: 


1 This event is implemented. 





[14] 


Ox@E 


BR_RETURN_ RETIRED 


Instruction architecturally executed, condition check pass - procedure 
return: 


(2 This event is not implemented. 





[13] 


@x@D 


BR_IMMED RETIRED 


Instruction architecturally executed - immediate branch: 


1 This event is implemented. 





[12] 


@x@C 


PC_WRITE RETIRED 


Instruction architecturally executed, condition check pass - software 
change of the PC: 


1 This event is implemented. 





[11] 


@x@B 


CID_WRITE_ RETIRED 


Instruction architecturally executed, condition check pass - write to 
CONTEXTIDR: 


1 This event is implemented. 





[10] 


Ox0A 


EXC_RETURN 


Instruction architecturally executed, condition check pass - exception 
return: 


1 This event is implemented. 





[9] 


0x09 


EXC_TAKEN 


Exception taken: 


1 This event is implemented. 





0x08 


INST_RETIRED 


Instruction architecturally executed: 


1 This event is implemented. 








[7] 


0x07 


ST_RETIRED 


Instruction architecturally executed, condition check pass - store: 


1 This event is implemented. 








[6] 


0x06 


LD_RETIRED 


Instruction architecturally executed, condition check pass - load: 


1 This event is implemented. 








[5] 


0x05 


L1D_TLB_REFILL 


L1 Data TLB refill: 


1 This event is implemented. 








[4] 


0x04 


L1D_CACHE 


L1 Data cache access: 


1 This event is implemented. 





[3] 


0x03 


LID_CACHE_ REFILL 


L1 Data cache refill: 


1 This event is implemented. 





[2] 








0x02 





LII TLB REFILL 





L1 Instruction TLB refill: 


1 This event is implemented. 
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C10.7 Performance Monitors Common Event Identification Register 0, ELO 


Table C10-5 PMU common events (continued) 














Bit | Event number | Event mnemonic Description 
[1] | 0x01 L1I CACHE _ REFILL L1 Instruction cache refill: 
1 This event is implemented. 
[0] | 0x00 SW_INCR Instruction architecturally executed, condition check pass - software 











increment: 


1 This event is implemented. 








To access the PMCEIDO_ ELO: 


MRS <Xt>, PMCEID@_EL@; Read Performance Monitor Common Event Identification Register @ 


The PMCEIDO_ELO can be accessed through the external debug interface, offset @xE20. 
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C10.8 Performance Monitors Common Event Identification Register 1, ELO 
The PMCEID1_ELO characteristics are: 


Purpose 
Defines which common architectural and common microarchitectural feature events are 
implemented. 

Usage constraints 
This register is accessible as follows: 


























ELO |EL1 |EL1/EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
Config| RO |RO |RO |RO RO 








This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1. 


Configurations 
The PMCEID1_ELO is architecturally mapped to: 
e The AArch32 register PMCEID1. See C/0.4 Performance Monitors Common Event 
Identification Register 1 on page C10-671. 
¢ The external register PMCEID1_ ELO. 


Attributes 
PMCEID1_ELO is a 32-bit register. 
31 17 16 0 
Figure C10-6 PMCEID1 bit assignments 
[31:17] 
RESO. 


CE[48:32], [16:0] 
Common architectural and microarchitectural feature events that can be counted by the PMU 
event counters. 


For each bit described in The following table, the event is implemented if the bit is set to 1, or 
not implemented if the bit is set to 0. 


Table C10-6 PMU common events 









































Bit | Event number | Event mnemonic Description 
[16] | 0x30 L2I TLB Attributable Level 2 instruction TLB access. 
(2 This event is not implemented. 
[15] | @x2F L2D_ TLB Attributable Level 2 data or unified TLB access. 
(2 This event is not implemented. 
[14] | @x2E L2I TLB_REFILL Attributable Level 2 instruction TLB refill. 
(2 This event is not implemented. 
[13] | @x2D L2D TLB_REFIL Attributable Level 2 data or unified TLB refill. 
(2 This event is not implemented. 
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C10.8 Performance Monitors Common Event Identification Register 1, ELO 


Table C10-6 PMU common events (continued) 










































































Bit | Event number | Event mnemonic Description 
[12] | @x2C L3D_CACHE_WB Attributable Level 3 data or unified cache write-back. 
(2 This event is not implemented. 
[11] | 0x2B L3D_ CACHE Attributable Level 3 data or unified cache access. 
(2 This event is not implemented. 
[10] | @x2A L3D_CACHE_REFILL Attributable Level 3 data or unified cache refill. 
(2 This event is not implemented. 
[9] | 0x29 L3D_CACHE_ALLOCATE | Attributable Level 3 data or unified cache allocation without refill. 
(2 This event is not implemented. 
[8] | 0x28 L2I CACHE REFILL Attributable Level 2 instruction cache refill. 
2) This event is not implemented. 
[7] | @x27 L2I CACHE Attributable Level 2 instruction cache access. 
(2 This event is not implemented. 
[6] | 0x26 L1I TLB Level 1 instruction TLB access. 
(2 This event is not implemented. 
[5] | 0x25 LID TLB Level 1 data or unified TLB access. 
(2 This event is not implemented. 
[4] | 0x24 STALL_BACKEND No operation issued due to backend. 
(2 This event is not implemented. 
[3] | 0x23 STALL_FRONTEND No operation issued due to the frontend. 
(2 This event is not implemented. 
[2] | 0x22 BR_MIS_PRED_RETIRED | Instruction architecturally executed, mispredicted branch. 
(2 This event is not implemented. 
[1] |0x21 BR_RETIRED Instruction architecturally executed, branch. 
(2 This event is not implemented. 
[0] | 0x20 L2D_CACHE_ALLOCATE | Level 2 data cache allocation without refill. 
(2 This event is not implemented. 











To access the PMCEID1_ELO: 


MRS <Xt>, PMCEID1_EL@; Read Performance Monitor Common Event Identification Register @ 


The PMCEID1_ELO can be accessed through the external debug interface, offset 0xE24. 
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C10 PMU registers 


C10.9 Memory-mapped PMU register summary 








































































































C10.9 Memory-mapped PMU register summary 
There are PMU registers that are accessible through the external debug interface. 
These registers are listed in the following table. For those registers not described in this chapter, see the 
ARM” Architecture Reference Manual ARMV6, for ARMv8-A architecture profile. 
Table C10-7 Memory-mapped PMU register summary 

Offset Name Type | Description 

0x000 PMEVCNTRO_ELO RW | Performance Monitors Event Count Register 0 

0x004 - - Reserved 

0x008 PMEVCNTRI ELO RW | Performance Monitors Event Count Register 1 

@xe@@C - - Reserved 

0x010 PMEVCNTR2_EL0 RW | Performance Monitors Event Count Register 2 

0x014 - - Reserved 

0x018 PMEVCNTR3_EL0 RW |Performance Monitors Event Count Register 3 

@x@1C - - Reserved 

0x020 PMEVCNTR4 ELO RW _| Performance Monitors Event Count Register 4 

0x024 - - Reserved 

0x028 PMEVCNTRS_ELO RW | Performance Monitors Event Count Register 5 

@x@2C-OxF4 |- - Reserved 

OxOF8 PMCCNTR_ELO[31:0] | RW _ | Performance Monitors Cycle Count Register 

@x@FC PMCCNTR_EL0[63:32] | RW 

@x100-O@x3FC | - - Reserved 

0x400 PMEVTYPERO ELO RW |Performance Monitors Event Type Register 

0x404 PMEVTYPER1_EL0 RW 

0x408 PMEVTYPER2_EL0 RW 

0x40C PMEVTYPER3_EL0 RW 

0x410 PMEVTYPER4 ELO RW 

0x414 PMEVTYPERS_ELO RW 

@x418-0x478 | - - Reserved 

@x47C PMCCFILTR_ELO RW_| Performance Monitors Cycle Count Filter Register 

@x480-OxBFC | - - Reserved 

@xCee PMCNTENSET_ELO RW | Performance Monitors Count Enable Set Register 

@xC@4-@xC1C | - - Reserved 

@xC20 PMCNTENCLR ELO | RW _ | Performance Monitors Count Enable Clear Register 

@xC24-@xC3C | - - Reserved 

@xCc4e PMINTENSET_ EL1 RW_| Performance Monitors Interrupt Enable Set Register 











@xC44-@xC5C 








Reserved 
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C10 PMU registers 


C10.9 Memory-mapped PMU register summary 


Table C10-7 Memory-mapped PMU register summary (continued) 














































































































Offset Name Type | Description 

@xC60 PMINTENCLR_EL1 RW_| Performance Monitors Interrupt Enable Clear Register 

@xC64-@xC7C | - - Reserved 

@xC8O PMOVSCLR_ELO RW_| Performance Monitors Overflow Flag Status Register 

@xC84-@xC9C | - - Reserved 

@xCA@ PMSWINC_ELO WO | Performance Monitors Software Increment Register 

@xCA4-@xCBC | - - Reserved 

@xCCce PMOVSSET_ELO RW_| Performance Monitors Overflow Flag Status Set Register 

@xCC4-@xDFC | - - Reserved 

@xE@O PMCFGR RO | C/0.10 Performance Monitors Configuration Register on page C10-686 

@xE04 PMCR_ELO RW _| Performance Monitors Control Register 

@xE@8-OxE1C | - - Reserved 

@xE20 PMCEID0O_ELO RO | C10.7 Performance Monitors Common Event Identification Register 0, ELO 
on page C10-677 

@xE24 PMCEID1_ELO RO | C10.8 Performance Monitors Common Event Identification Register 1, ELO 
on page C10-681 

@xE28-OxFA4 |- - Reserved 

OxFA8 PMDEVAFFO0 RO | Performance Monitors Device Affinity Register 0, see B2.84 Multiprocessor 
Affinity Register, EL] on page B2-494 

@xFAC PMDEVAFF 1 RO | Performance Monitors Device Affinity Register 1, see 82.84 Multiprocessor 
Affinity Register, EL] on page B2-494 

OxFBO PMLAR WO _ | Performance Monitors Lock Access Register 

@xFB4 PMLSR RO [Performance Monitors Lock Status Register 

@xFB8 PMAUTHSTATUS RO | Performance Monitors Authentication Status Register 

@xFBC PMDEVARCH Performance Monitors Device Architecture Register 

@xFCO-OxFC8 | - - Reserved 

@xFCC PMDEVTYPE RO _ | Performance Monitors Device Type Register 

@xFDO PMPIDR4 RO | C/0.16 Performance Monitors Peripheral Identification Register 4 
on page C10-692 

@xFD4 PMPIDRS5 RO | C/0.17 Performance Monitors Peripheral Identification Register 5-7 

@xFD8 PMPIDR6 T a 

@xFDC PMPIDR7 RO 

OxFEO PMPIDRO RO | C10.12 Performance Monitors Peripheral Identification Register 0 
on page C10-688 

OxFE4 PMPIDR1 RO | C/0.13 Performance Monitors Peripheral Identification Register 1 
on page C10-689 

OxFE8 PMPIDR2 RO |C10.14 Performance Monitors Peripheral Identification Register 2 


on page C10-690 
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C10 PMU registers 
C10.9 Memory-mapped PMU register summary 


Table C10-7 Memory-mapped PMU register summary (continued) 




















Offset Name Type | Description 

@xFEC PMPIDR3 RO | C/0.15 Performance Monitors Peripheral Identification Register 3 
on page C10-691 

OxFFO PMCIDRO RO | C/0.19 Performance Monitors Component Identification Register 0 
on page C10-695 

OxFF4 PMCIDR1 RO | C10.20 Performance Monitors Component Identification Register 1 
on page C10-696 

OxFF8 PMCIDR2 RO | C/0.21 Performance Monitors Component Identification Register 2 
on page C10-697 

@xFFC PMCIDR3 RO | C/0.22 Performance Monitors Component Identification Register 3 








on page C10-698 
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C10.10 Performance Monitors Configuration Register 


C10.10 Performance Monitors Configuration Register 
The PMCFGR characteristics are: 


Purpose 
Contains PMU specific configuration data. 
Usage constraints 
The accessibility to the PMCFGR by condition code is: 





Off |DLK | OSLK | EPMAD | SLK | Default 




















Error | Error | Error | Error RO |RO 





C2.2 External register access permissions to the PMU registers on page C2-561 describes the 
condition codes. 


Configurations 
The PMCFGR is in the processor power domain. 
Attributes 
See C10.9 Memory-mapped PMU register summary on page C10-683. 


31 17 16 15 14 13 8 7 0 


L cce 
CCD 
EX 


Figure C10-7 PMCFGR bit assignments 


[31:17] 
Reserved, RESO. 
EX, [16] 
Export supported. The value is: 


1 Export is supported. PMCR_EL0.EX is read/write. 


CCD, [15] 
Cycle counter has pre-scale. The value is: 


1 PMCR_ELO.D is read/write. 


CC, [14] 
Dedicated cycle counter supported. The value is: 


1 Dedicated cycle counter is supported. 
Size, [13:8] 

Counter size. The value is: 

@b111111 64-bit counters. 
N, [7:0] 

Number of event counters. The value is: 


0x06 Six counters. 


The PMCFGR can be accessed through the external debug interface, offset @xEee. 
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C10.11 Performance Monitors Peripheral Identification Registers 


The Performance Monitors Peripheral Identification Registers provide standard information required for 
all components that conform to the ARM PMUv3 architecture. 


The following table lists the Performance Monitors Peripheral Identification Registers. 


Table C10-8 Summary of the Performance Monitors Peripheral Identification Registers 





Register Value | Offset 





Peripheral ID4 | 0x04 | @xFD@ 





Peripheral ID5 | 0x00 | OxFD4 





Peripheral ID6 | 0x00 | OxFD8 





Peripheral ID7 | 0x00 | @xFDC 





Peripheral IDO | @xDA | OxFE@ 





Peripheral ID1 | @xB9 | @xFE4 





Peripheral ID2 | @x2B | OxFE8 





Peripheral ID3 | 0x00 | @xFEC 

















Only bits[7:0] of each Peripheral ID Register are used, with bits[31:8] reserved. Together, the eight 
Peripheral ID Registers define a single 64-bit Peripheral ID. 





ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights C10-687 
reserved. 
Non-Confidential 


C10 PMU registers 
C10.12 Performance Monitors Peripheral Identification Register 0 


C10.12 Performance Monitors Peripheral Identification Register 0 
The PMPIDR0O characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


Usage constraints 
The PMPIDRO can be accessed through the external debug interface. 


The accessibility to the PMPIDRO by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 
z fe ija : RO [RO 


























C2.2 External register access permissions to the PMU registers on page C2-561 describes the 
condition codes. 


Configurations 
The PMPIDRO is in the Debug power domain. 
Attributes 
See the register summary in C/0.9 Memory-mapped PMU register summary on page C10-683. 


31 8 7 0 


Figure C10-8 PMPIDRO bit assignments 


[31:8] 
Reserved, RESO. 
Part_0, [7:0] 


@xDA Least significant byte of the performance monitor part number. 


The PMPIDRO can be accessed through the external debug interface, offset @xFE@. 
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C10.13 Performance Monitors Peripheral Identification Register 1 
The PMPIDR1 characteristics are: 


Purpose 

Provides information to identify a Performance Monitor component. 
Usage constraints 

The PMPIDRI can be accessed through the external debug interface. 


The accessibility to the PMPIDR1 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





- - - - RO |RO 























C2.2 External register access permissions to the PMU registers on page C2-561 describes the 
condition codes. 


Configurations 
The PMPIDR1 is in the Debug power domain. 
Attributes 
See the register summary in C/0.9 Memory-mapped PMU register summary on page C10-683. 


31 8 7 4 3 0 


Figure C10-9 PMPIDR1 bit assignments 


[31:8] 
Reserved, RESO. 
DES_0, [7:4] 


@xB ARM Limited. This is the least significant nibble of JEP106 ID code. 


Part_1, [3:0] 


@x9 Most significant nibble of the performance monitor part number. 


The PMPIDRI can be accessed through the external debug interface, offset @xFE4. 
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C10.14 Performance Monitors Peripheral Identification Register 2 
The PMPIDR2 characteristics are: 


Purpose 

Provides information to identify a Performance Monitor component. 
Usage constraints 

The accessibility to the PMPIDR2 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





- RO |RO 























C2.2 External register access permissions to the PMU registers on page C2-561 describes the 
condition codes. 


The PMPIDR2 can be accessed through the external debug interface. 


Configurations 
The PMPIDR2 is in the Debug power domain. 
Attributes 
See the register summary in C/0.9 Memory-mapped PMU register summary on page C10-683. 
31 8 7 4 3 2 0 
| rion | | es 
JEDEC + 


Figure C10-10 PMPIDR2 bit assignments 


[31:8] 
Reserved, RESO. 
Revision, [7:4] 


0x2 r0p2. 


JEDEC, [3] 
@b1 RAO. Indicates a JEP 106 identity code is used. 


DES _1, [2:0] 
@be11 ARM Limited. This is the most significant nibble of JEP106 ID code. 


The PMPIDR2 can be accessed through the external debug interface, offset @xFE8. 
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C10.15 Performance Monitors Peripheral Identification Register 3 
The PMPIDR3 characteristics are: 


Purpose 

Provides information to identify a Performance Monitor component. 
Usage constraints 

The PMPIDR3 can be accessed through the external debug interface. 


The accessibility to the PMPIDR3 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 








- - - - RO |RO 




















C2.2 External register access permissions to the PMU registers on page C2-561 describes the 
condition codes. 


Configurations 
The PMPIDR3 is in the Debug power domain. 
Attributes 
See the register summary in C/0.9 Memory-mapped PMU register summary on page C10-683. 


31 8 7 4 3 0 


Figure C10-11 PMPIDR3 bit assignments 


[31:8] 
Reserved, RESO. 
REVAND, [7:4] 


@xe Part minor revision. 
CMOD, [3:0] 
@xe Customer modified. 


The PMPIDR3 can be accessed through the external debug interface, offset @xFEC. 
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C10 PMU registers 
C10.16 Performance Monitors Peripheral Identification Register 4 


C10.16 Performance Monitors Peripheral Identification Register 4 
The PMPIDR4 characteristics are: 


Purpose 

Provides information to identify a Performance Monitor component. 
Usage constraints 

The PMPIDR4 can be accessed through the external debug interface. 


The accessibility to the PMPIDR4 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 








- - - - RO |RO 




















C2.2 External register access permissions to the PMU registers on page C2-561 describes the 
condition codes. 


Configurations 
The PMPIDR4 is in the Debug power domain. 
Attributes 
See the register summary in C/0.9 Memory-mapped PMU register summary on page C10-683. 


31 8 7 4 3 0 


Figure C10-12 PMPIDR4 bit assignments 


[31:8] 
Reserved, RESO. 
Size, [7:4] 


exe Size of the component. Log2 the number of 4KB pages from the start of the 
component to the end of the component ID registers. 


DES 2, [3:0] 
0x4 ARM Limited. This is the least significant nibble JEP106 continuation code. 


The PMPIDR4 can be accessed through the external debug interface, offset @xFD@. 
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C10 PMU registers 
C10.17 Performance Monitors Peripheral Identification Register 5-7 


C10.17 Performance Monitors Peripheral Identification Register 5-7 
No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. 


They are reserved for future use and are RESO. 
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C10 PMU registers 
C10.18 Performance Monitors Component Identification Registers 


C10.18 Performance Monitors Component Identification Registers 


There are four read-only PMU Component Identification Registers, Component IDO through Component 
ID3. 


Table C10-9 Summary of the Performance Monitors Component Identification Registers 





Register Value | Offset 





Component IDO | @x@D | @xFF@ 





Component ID1 | 0x90 | O@xFF4 





Component ID2 | 0x05 | OxFF8 





Component ID3 | @xB1 | @xFFC 

















The Performance Monitors Component Identification Registers identify Performance Monitor as ARM 
PMUV3 architecture. 
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C10.19 Performance Monitors Component Identification Register 0 


The PMCIDRO characteristics are: 


Purpose 


Provides information to identify a Performance Monitor component. 


Usage constraints 


The PMCIDRO can be accessed through the external debug interface. 


The accessibility to the PMCIDRO by condition code is: 


C10 PMU registers 
C10.19 Performance Monitors Component Identification Register 0 





Off | DLK 


OSLK 


EPMAD 


SLK | Default 




















RO |RO 








C2.2 External register access permissions to the PMU registers on page C2-561 describes the 


condition codes. 


Configurations 
The PMCIDRO is in the Debug power domain. 
Attributes 


See the register summary in C/0.9 Memory-mapped PMU register summary on page C10-683. 


31 


8 7 


0 


Figure C10-13 PMCIDRO bit assignments 


[31:8] 
Reserved, RESO. 
Size, [7:0] 


@x@D Preamble byte 0. 


The PMCIDRO can be accessed through the external debug interface, offset @xFF®. 
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C10 PMU registers 
C10.20 Performance Monitors Component Identification Register 1 


C10.20 Performance Monitors Component Identification Register 1 
The PMCIDRI characteristics are: 


Purpose 

Provides information to identify a Performance Monitor component. 
Usage constraints 

The PMCIDR1I can be accessed through the external debug interface. 


The accessibility to the PMCIDR1 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 








- - - - RO |RO 




















C2.2 External register access permissions to the PMU registers on page C2-561 describes the 
condition codes. 


Configurations 
The PMCIDR1 is in the Debug power domain. 
Attributes 
See the register summary in C/0.9 Memory-mapped PMU register summary on page C10-683. 


31 8 7 4 3 0 


Figure C10-14 PMCIDR1 bit assignments 


[31:8] 
Reserved, RESO. 
CLASS, [7:4] 


0x9 Debug component. 
PRMBL 1, [3:0] 
@x® Preamble byte 1. 


The PMCIDRI can be accessed through the external debug interface, offset @xFF4. 
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C10 PMU registers 
C10.21 Performance Monitors Component Identification Register 2 


C10.21 Performance Monitors Component Identification Register 2 
The PMCIDR2 characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


Usage constraints 
The PMCIDR2 can be accessed through the external debug interface. 


The accessibility to the PMCIDR2 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 
z fe ija : RO [RO 


























C2.2 External register access permissions to the PMU registers on page C2-561 describes the 
condition codes. 


Configurations 
The PMCIDR2 is in the Debug power domain. 
Attributes 
See the register summary in C/0.9 Memory-mapped PMU register summary on page C10-683. 


31 8 7 0 


Figure C10-15 PMCIDR2 bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 2, [7:0] 


@x@5 Preamble byte 2. 


The PMCIDR2 can be accessed through the external debug interface, offset @xFF8. 
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C10 PMU registers 
C10.22 Performance Monitors Component Identification Register 3 


C10.22 Performance Monitors Component Identification Register 3 
The PMCIDR3 characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


Usage constraints 
The PMCIDR3 can be accessed through the external debug interface. 


The accessibility to the PMCIDR3 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 
z fe ija : RO [RO 


























C2.2 External register access permissions to the PMU registers on page C2-561 describes the 
condition codes. 


Configurations 
The PMCIDR3 is in the Debug power domain. 
Attributes 
See the register summary in C/0.9 Memory-mapped PMU register summary on page C10-683. 


31 8 7 0 


Figure C10-16 PMCIDR3 bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 3, [7:0] 


@xB1 Preamble byte 3. 


The PMCIDR3 can be accessed through the external debug interface, offset @xFFC. 
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Chapter C11 
ETM registers 


This chapter describes the ETM registers. 


It contains the following sections: 

e Cll.1 ETM register summary on page C11-701. 

e C11.2 Programming Control Register on page C11-704. 

e CIl.3 Status Register on page C11-705. 

e C1l.4 Trace Configuration Register on page C11-706. 

e C11.5 Branch Broadcast Control Register on page C11-708. 

e C11.6 Auxiliary Control Register on page C11-709. 

e Cl1.7 Event Control 0 Register on page C11-711. 

e C11.8 Event Control I Register on page C11-713. 

e C11.9 Stall Control Register on page C11-714. 

e C11.10 Global Timestamp Control Register on page C11-715. 
e C11.11 Synchronization Period Register on page C11-716. 

e C11.12 Cycle Count Control Register on page C11-717. 

e Cl1.13 Trace ID Register on page C11-718. 

e Cl11.14 ViewInst Main Control Register on page C11-719. 

e C11.15 ViewInst Include-Exclude Control Register on page C11-721. 
e C11.16 ViewInst Start-Stop Control Register on page C11-722. 
e Cll1.17 Sequencer State Transition Control Registers 0-2 on page C11-723. 
e C11.18 Sequencer Reset Control Register on page C11-725. 

e CI11.19 Sequencer State Register on page C11-726. 

e C11.20 External Input Select Register on page C11-727. 

e C11.21 Counter Reload Value Registers 0-1 on page C11-728. 
e C11.22 Counter Control Register 0 on page C11-729. 

e C11.23 Counter Control Register 1 on page C11-730. 
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C11 ETM registers 


e C11.24 Counter Value Registers 0-1 on page C11-732. 

e Cl11.25 ID Register 8 on page C11-733. 

e C11.26 ID Register 9 on page C11-734. 

e CI11.27 ID Register 10 on page C11-735. 

e C11.28 ID Register 11 on page C11-736. 

e CI11.29 ID Register 12 on page C11-737. 

e CI11.30 ID Register 13 on page C11-738. 

e C11.31 Implementation Specific Register 0 on page C11-739. 

e Cl1I.32 ID Register 0 on page C11-740. 

e CI11.33 ID Register 1 on page C11-742. 

e C11.34 ID Register 2 on page C11-743. 

e CI11.35 ID Register 3 on page C11-744. 

e C11.36 ID Register 4 on page C11-746. 

e CI11.37 ID Register 5 on page C11-747. 

e C11.38 Resource Selection Control Registers 2-16 on page C11-749. 
e C11.39 Single-Shot Comparator Control Register 0 on page C11-750. 
e C11.40 Single-Shot Comparator Status Register 0 on page C11-751. 
e C11.41 OS Lock Access Register on page C11-752. 

e C11.42 OS Lock Status Register on page C11-753. 

e C11.43 Power Down Control Register on page C11-754. 

e CI11.44 Power Down Status Register on page C11-755. 

e C11.45 Address Comparator Value Registers 0-7 on page C11-756. 
¢ C11.46 Address Comparator Access Type Registers 0-7 on page C11-757. 
e C11.47 Context ID Comparator Value Register 0 on page C11-759. 

e C11.48 VMID Comparator Value Register 0 on page C11-760. 

e C11.49 Context ID Comparator Control Register 0 on page C11-761. 
e C11.50 Integration ATB Identification Register on page C11-762. 

e CIl.51 Integration Instruction ATB Data Register on page C11-763. 
e CIl.52 Integration Instruction ATB In Register on page C11-764. 

e CIl.53 Integration Instruction ATB Out Register on page C11-765. 
e C11.54 Integration Mode Control Register on page C11-766. 

e C11.55 Claim Tag Set Register on page C11-767. 

e C11.56 Claim Tag Clear Register on page C11-768. 

e C11.57 Device Affinity Register 0 on page C11-769. 

e C11.58 Device Affinity Register 1 on page C11-771. 

e C11.59 Software Lock Access Register on page C11-772. 

e C11.60 Software Lock Status Register on page C11-773. 

e C11.6l Authentication Status Register on page C11-774. 

e C11.62 Device Architecture Register on page C11-775. 

e C11.63 Device ID Register on page C11-776. 

e Cl11.64 Device Type Register on page C11-777. 

e C11.65 ETM Peripheral Identification Registers on page C11-778. 

e C11.66 ETM Peripheral Identification Register 0 on page C11-779. 
e C11.67 ETM Peripheral Identification Register 1 on page C11-780. 
e C11.68 ETM Peripheral Identification Register 2 on page C11-781. 
e C11.69 ETM Peripheral Identification Register 3 on page C11-782. 
e C11.70 ETM Peripheral Identification Register 4 on page C11-783. 
e C11.71 ETM Peripheral Identification Register 5-7 on page C11-784. 
e C11.72 ETM Component Identification Registers on page C11-785. 
e C11.73 ETM Component Identification Register 0 on page C11-786. 
e C11.74 ETM Component Identification Register 1 on page C11-787. 
e C11.75 ETM Component Identification Register 2 on page C11-788. 
e C11.76 ETM Component Identification Register 3 on page C11-789. 
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C11 ETM registers 
C11.1 ETM register summary 


C11.1 ETM register summary 
This section summarizes the ETM trace unit registers. 


All ETM trace unit registers are 32 bits wide. The description of each register includes its offset from a 
base address. The base address is defined by the system integrator when placing the ETM trace unit in 
the Debug-APB memory map. 


Table C11-1 ETM trace unit register summary 





Name Type Description 





TRCPRGCTLR RW C11.2 Programming Control Register on page C11-704 





TRCSTATR RO C11.3 Status Register on page C11-705 





TRCCONFIGR RW C11.4 Trace Configuration Register on page C11-706 





TRCAUXCTLR RW C11.6 Auxiliary Control Register on page C11-709 





TRCEVENTCTLOR | RW C11.7 Event Control 0 Register on page C11-711 





TRCEVENTCTLIR | RW C11.8 Event Control 1 Register on page C11-713 





TRCSTALLCTLR | RW C11.9 Stall Control Register on page C11-714 














TRCTSCTLR RW C11.10 Global Timestamp Control Register on page C11-715 
TRCSYNCPR RW C11.11 Synchronization Period Register on page C11-716 
TRCCCCTLR RW C11.12 Cycle Count Control Register on page C11-717 
TRCBBCTLR RW C11.5 Branch Broadcast Control Register on page C11-708 





TRCTRACEIDR RW C11.13 Trace ID Register on page C11-718 





TRCVICTLR RW C11.14 ViewInst Main Control Register on page C11-719 





TRCVHECTLR RW C11.15 ViewInst Include-Exclude Control Register on page C11-721 





TRCVISSCTLR RW C11.16 ViewInst Start-Stop Control Register on page C11-722 











TRCSEQEVRO RW C11.17 Sequencer State Transition Control Registers 0-2 on page C11-723 
TRCSEQEVRI1 RW C11.17 Sequencer State Transition Control Registers 0-2 on page C11-723 
TRCSEQEVR2 RW C11.17 Sequencer State Transition Control Registers 0-2 on page C11-723 





TRCSEQRSTEVR | RW C11.18 Sequencer Reset Control Register on page C11-725 





TRCSEQSTR RW C11.19 Sequencer State Register on page C11-726 





TRCEXTINSELR | RW C11.20 External Input Select Register on page C11-727 





TRCCNTRLDVRO | RW C11.21 Counter Reload Value Registers 0-1 on page C11-728 





TRCCNTRLDVRI | RW C11.21 Counter Reload Value Registers 0-1 on page C11-728 





TRCCNTCTLRO RW C11.22 Counter Control Register 0 on page C11-729 





TRCCNTCTLRI RW C11.23 Counter Control Register 1 on page C11-730 






































TRCCNTVRO RW C11.24 Counter Value Registers 0-1 on page C11-732 
TRCCNTVRI1 RW C11.24 Counter Value Registers 0-1 on page C11-732 
TRCIDR8 RO C11.25 ID Register 8 on page C11-733 
TRCIDR9 RO C11.26 ID Register 9 on page C11-734 
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C11 ETM registers 
C11.1 ETM register summary 


Table C11-1 ETM trace unit register summary (continued) 




































































Name Type Description 

TRCIDR1O RO C11.27 ID Register 10 on page C11-735 

TRCIDRI1 RO C11.28 ID Register 11 on page C11-736 

TRCIDRI12 RO C11.29 ID Register 12 on page C11-737 

TRCIDR13 RO C11.30 ID Register 13 on page C11-738 

TCRIMSPECO RW C11.31 Implementation Specific Register 0 on page C11-739 
TRCIDRO RO C11.32 ID Register 0 on page C11-740 

TRCIDRI1 RO C11.33 ID Register 1 on page C11-742 

TRCIDR2 RO C11.34 ID Register 2 on page C11-743 

TRCIDR3 RO C11.35 ID Register 3 on page C11-744 

TRCIDR4 RO C11.36 ID Register 4 on page C11-746 

TRCIDRS RO C11.37 ID Register 5 on page C11-747 

TRCRSCTLRn RW C11.38 Resource Selection Control Registers 2-16 on page C11-749, n is 2, 15 
TRCSSCCRO RW C11.39 Single-Shot Comparator Control Register 0 on page C11-750 
TRCSSCSRO RW, RO | C1/.40 Single-Shot Comparator Status Register 0 on page C11-751 
TRCOSLAR WO C11.41 OS Lock Access Register on page C11-752 

TRCOSLSR RO C11.42 OS Lock Status Register on page C11-753 

TRCPDCR RW C11.43 Power Down Control Register on page C11-754 

TRCPDSR RO C11.44 Power Down Status Register on page C11-755 

TRCACVRn RW C11.45 Address Comparator Value Registers 0-7 on page C11-756 
TRCACATRn RW C11.46 Address Comparator Access Type Registers 0-7 on page C11-757> 
TRCCIDCVRO RW C11.47 Context ID Comparator Value Register 0 on page C11-759 





TRCVMIDCVRO RW C11.48 VMID Comparator Value Register 0 on page C11-760 





TRCCIDCCTLRO | RW C11.49 Context ID Comparator Control Register 0 on page C11-761 





TRCITATBIDR RW C11.50 Integration ATB Identification Register on page C11-762 





TRCITIDATAR WO C11.51 Integration Instruction ATB Data Register on page C11-763 





TRCITIATBINR RO C11.52 Integration Instruction ATB In Register on page C11-764 





TRCITIATBOUTR | WO C11.53 Integration Instruction ATB Out Register on page C11-765 





TRCITCTRL RW C11.54 Integration Mode Control Register on page C11-766 





TRCCLAIMSET RW C11.55 Claim Tag Set Register on page C11-767 





TRCCLAIMCLR RW C11.56 Claim Tag Clear Register on page C11-768 














TRCDEVAFFO RO C11.57 Device Affinity Register 0 on page C11-769 
TRCDEVAFF1 RO C11.58 Device Affinity Register 1 on page C11-771 
TRCLAR WO C11.59 Software Lock Access Register on page C11-772 
TRCLSR RO C11.60 Software Lock Status Register on page C11-773 





TRCAUTHSTATUS | RO C11.61 Authentication Status Register on page C11-774 
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C11 ETM registers 
C11.1 ETM register summary 


Table C11-1 ETM trace unit register summary (continued) 




































































Name Type Description 

TRCDEVARCH RO C11.62 Device Architecture Register on page C11-775 

TRCDEVID RO C11.63 Device ID Register on page C11-776 

TRCDEVTYPE RO C11.64 Device Type Register on page C11-777 

TRCPIDR4 RO C11.70 ETM Peripheral Identification Register 4 on page C11-783 

TRCPIDRS RO C11.71 ETM Peripheral Identification Register 5-7 on page C11-784 

TRCPIDR6 RO 

TRCPIDR7 RO 

TRCPIDRO RO C11.66 ETM Peripheral Identification Register 0 on page C11-779 

TRCPIDRI1 RO C11.67 ETM Peripheral Identification Register 1 on page C11-780 

TRCPIDR2 RO C11.68 ETM Peripheral Identification Register 2 on page C11-781 

TRCPIDR3 RO C11.69 ETM Peripheral Identification Register 3 on page C11-782 

TRCCIDRO RO C11.73 ETM Component Identification Register 0 on page C11-786 

TRCCIDRI1 RO C11.74 ETM Component Identification Register 1 on page C11-787 

TRCCIDR2 RO C11.75 ETM Component Identification Register 2 on page C11-788 

TRCCIDR3 RO C11.76 ETM Component Identification Register 3 on page C11-789 
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C11 ETM registers 
C11.2 Programming Control Register 


C11.2 Programming Control Register 
The TRCPRGCTLR characteristics are: 


Purpose 
Enables the ETM trace unit. 
Usage constraints 
See C3.4 Programming and reading ETM trace unit registers on page C3-575. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


en 


Figure C11-1 TRCPRGCTLR bit assignments 


[31:1] 
Reserved, RESO. 
EN, [0] 
Trace program enable: 
© The ETM trace unit interface in the processor is disabled, and clocks are enabled only when 
necessary to process APB accesses, or drain any already generated trace. This is the reset 
value. 
1 The ETM trace unit interface in the processor is enabled, and clocks are enabled. Writes to 
most trace registers are ignored. 


The TRCPRGCTLR can be accessed through the external debug interface, offset 0x004. 
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C11 ETM registers 
C11.3 Status Register 


Status Register 


The TRCSTATR characteristics are: 


Purpose 
Indicates the ETM trace unit status. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 210 


em 
PMSTABLE —! 
IDLE 
Figure C11-2 TRCSTATR bit assignments 


[31:2] 
Reserved, RESO. 
PMSTABLE, [1] 
Indicates whether the ETM trace unit registers are stable and can be read: 


@ The programmers model is not stable. 

1 The programmers model is stable. 
IDLE, [0] 

Idle status: 

@ The ETM trace unit is not idle. 

1 The ETM trace unit is idle. 


The TRCSTATR can be accessed through the external debug interface, offset @x@eCc. 
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C11 ETM registers 
C11.4 Trace Configuration Register 


Trace Configuration Register 


The TRCCONFIGR characteristics are: 


Purpose 
Controls the tracing options. 

Usage constraints 
¢ This register must always be programmed as part of trace unit initialization. 
e Only accepts writes when the trace unit is disabled. 


Configurations 
Available in all configurations. 
Attributes 
TRCCOMFIGR is a 32-bit RW trace register. 


See C1l.] ETM register summary on page C11-701. 


31 13 12 11 10 876543 2 1 


se VMID =] RES1 -~ 
vo- | 
RESO 


CCl 
BB 


Figure C11-3 TRCCONFIGR bit assignments 


[31:13] 
Reserved, RESO. 
RS, [12] 
Enables the return stack. The possible values are: 
(3 Disables the return stack. 
1 Enables the return stack. 
TS, [11] 
Enables global timestamp tracing. The possible values are: 
(3 Disables global timestamp tracing. 
1 Enables global timestamp tracing. 
[10:8] 
Reserved, RESO. 
VMID, [7] 
Enables VMID tracing. The possible values are: 
(3 Disables VMID tracing. 
1 Enables VMID tracing. 
CID, [6] 
Enables context ID tracing. The possible values are: 
(2) Disables context ID tracing. 
1 Enables context ID tracing. 


[5] 
Reserved, RESO. 
CCI, [4] 
Enables cycle counting instruction trace. The possible values are: 
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C11 ETM registers 
C11.4 Trace Configuration Register 


(3 Disables cycle counting instruction trace. 
1 Enables cycle counting instruction trace. 
BB, [3] 
Enables branch broadcast mode. The possible values are: 
(3 Disables branch broadcast mode. 
1 Enables branch broadcast mode. 
[2:1] 


Reserved, RESO. 
[0] 


Reserved, RES1. 


The TRCCONFIGR can be accessed through the external debug interface, offset 0x010. 
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C11 ETM registers 
C11.5 Branch Broadcast Control Register 


Branch Broadcast Control Register 


The TRCBBCTLR characteristics are: 


Purpose 
Controls how branch broadcasting behaves, and enables branch broadcasting to be enabled for 
certain memory regions. 
Usage constraints 
e Only accepts writes when the trace unit is disabled. 
e Must be programmed if TRCCONFIGR.BB = 1. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
31 98 7 0 
mince | 
L— MODE 


Figure C11-4 TRCBBCTLR bit assignments 


[31:9] 
Reserved, RESO. 
MODE, [8] 
Mode bit: 
@ Exclude mode. Branch broadcasting is not enabled in the address range that RANGE defines. 
If RANGE==0 then branch broadcasting is enabled for the entire memory map. 
1 Include mode. Branch broadcasting is enabled in the address range that RANGE defines. 
If RANGE==0 then the behavior of the trace unit is constrained UNPREDICTABLE. That is, the 
trace unit might or might not consider any instructions to be in a branch broadcast region. 
RANGE, [7:0] 


Address range field. 


Selects which address range comparator pairs are in use with branch broadcasting. Each bit 
represents an address range comparator pair, so bit[n] controls the selection of address range 
comparator pair n. If bit[n] is: 


© The address range that address range comparator pair n defines, is not selected. 
1 The address range that address range comparator pair n defines, is selected. 


The TRCBBCTLR can be accessed through the external debug interface, offset @x@3C. 
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C11 ETM registers 
C11.6 Auxiliary Control Register 


Auxiliary Control Register 


The TRCAUXCTLR characteristics are: 


Purpose 
The function of this register is to provide IMPLEMENTATION DEFINED configuration and control 
options. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 
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Figure C11-5 TRCAUXCTLR bit assignments 


[31:8] 
Reserved, RESO. 
COREIFEN, [7] 
Keep core interface enabled regardless of trace enable register state. The possible values are: 


© Core interface enabled is set by trace enable register state. 

1 Enable core interface, regardless of trace enable register state. 
[6] 

Reserved, RESO. 


AUTHNOFLUSH, [5] 
Do not flush trace on de-assertion of authentication inputs. The possible values are: 


@ ETM trace unit FIFO is flushed and ETM trace unit enters idle state when DBGEN or 
NIDEN is LOW. 

1 ETM trace unit FIFO is not flushed and ETM trace unit does not enter idle state when 
DBGEN or NIDEN is LOW. 


When this bit is set to 1, the trace unit behavior deviates from architecturally-specified behavior. 


TSNODELAY, [4] 
Do not delay timestamp insertion based on FIFO depth. The possible values are: 


© Timestamp packets are inserted into FIFO only when trace activity is LOW. 


1 Timestamp packets are inserted into FIFO irrespective of trace activity. 


SYNCDELAY, [3] 
Delay periodic synchronization if FIFO is more than half-full. The possible values are: 


@ SYNC packets are inserted into FIFO only when trace activity is low. 
1 SYNC packets are inserted into FIFO irrespective of trace activity. 
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C11 ETM registers 
C11.6 Auxiliary Control Register 


OVFLW, [2] 
Force overflow if synchronization is not completed when second synchronization becomes due. 
The possible values are: 


@ No FIFO overflow when SYNC packets are delayed. 
1 Forces FIFO overflow when SYNC packets are delayed. 


When this bit is set to 1, the trace unit behavior deviates from architecturally-specified behavior. 


IDLEACK, [1] 
Force idle-drain acknowledge high, CPU does not wait for trace to drain before entering WFX 
state. The possible values are: 
© ETM trace unit idle acknowledge is asserted only when the ETM trace unit is in idle state. 
1 ETM trace unit idle acknowledge is asserted irrespective of the ETM trace unit idle state. 


When this bit is set to 1, trace unit behavior deviates from architecturally-specified behavior. 


AFREADY, [0] 
Always respond to AFREADY immediately. Does not have any interaction with FIFO draining, 
even in WFI state. The possible values are: 
© ETM trace unit AFREADYM output is asserted only when the ETM trace unit is in idle state 
or when all the trace bytes in FIFO before a flush request are output. 


1 ETM trace unit AFREADYM output is always asserted HIGH. When this bit is set to 1, 
trace unit behavior deviates from architecturally-specified behavior. 


The TRCAUXCTLR can be accessed through the external debug interface, offset 0x018. 
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C11.7 Event Control 0 Register 


Event Control 0 Register 


The TRCEVENTCTLOR characteristics are: 


Purpose 
Controls the tracing of events in the trace stream. The events also drive the external outputs 
from the ETM trace unit. The events are selected from the Resource Selectors. 
Usage constraints 
e You must always program this register as part of trace unit initialization. 
e Accepts writes only when the trace unit is disabled. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-6 TRCEVENTCLOR bit assignments 


TYPE3, [31] 
Selects the resource type for trace event 3: 


@ Single selected resource. 

1 Boolean combined resource pair. 
[30:28] 

Reserved, RESO. 


SEL3, [27:24] 
Selects the resource number, based on the value of TYPE3: 


When TYPE3 is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPE3 is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


TYPE2, [23] 
Selects the resource type for trace event 2: 


@ Single selected resource. 

1 Boolean combined resource pair. 
[22:20] 

Reserved, RESO. 


SEL2, [19:16] 
Selects the resource number, based on the value of TYPE2: 


When TYPE2 is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPE2 is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


TYPEF1, [15] 
Selects the resource type for trace event 1: 


@ Single selected resource. 


1 Boolean combined resource pair. 


[14:12] 
Reserved, RESO. 
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C11.7 Event Control 0 Register 


SEL1, [11:8] 
Selects the resource number, based on the value of TYPE1: 
When TYPE! is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPE! is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


TYPE, [7] 
Selects the resource type for trace event 0: 


@ Single selected resource. 


1 Boolean combined resource pair. 


[6:4] 
Reserved, RESO. 
SELO, [3:0] 
Selects the resource number, based on the value of TYPEO: 


When TYPEO is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPEO is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
The TRCEVENTCTLOR can be accessed through the external debug interface, offset 0x029. 
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C11.8 Event Control 1 Register 
The TRCEVENTCTLIR characteristics are: 
Purpose 
Controls the behavior of the events that TRCEVENTCTLOR selects. 
Usage constraints 
e You must always program this register as part of trace unit initialization. 
e Accepts writes only when the trace unit is disabled. 
Configurations 
Available in all configurations. 
Attributes 
TRCEVENTCTLIR is a 32-bit RW trace register. 
See C1l.] ETM register summary on page C11-701. 
31 13 12 11 10 8 7 5 4 3 0 
Pm 
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Figure C11-7 TRCEVENTCL1R bit assignments 
[31:13] 
Reserved, RESO. 
LPOVERRIDE, [12] 
Low-power state behavior override: 
(3 Low-power state behavior unaffected. 
1 Low-power state behavior overridden. The resources and Event trace generation are 
unaffected by entry to a low-power state. 
ATB, [11] 
ATB trigger enable: 
(3 ATB trigger disabled. 
1 ATB trigger enabled. 
[10:4] 
Reserved, RESO. 
EN, [3:0] 
One bit per event, to enable generation of an event element in the instruction trace stream when 
the selected event occurs: 
(3 Event does not cause an event element. 
1 Event causes an event element. 
The TRCEVENTCTLIR can be accessed through the external debug interface, offset 0x024. 
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C11.9 Stall Control Register 
The TRCSTALLCTLR characteristics are: 


Purpose 
Enables the ETM trace unit to stall the Cortex-A35 processor if the ETM trace unit FIFO 
overflows. 
Usage constraints 
e You must always program this register as part of trace unit initialization. 
e Accepts writes only when the trace unit is disabled. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-8 TRCSTALLCTLR bit assignments 


[31:9] 
Reserved, RESO. 
ISTALL, [8] 
Instruction stall bit. Controls if the trace unit can stall the processor when the instruction trace 
buffer space is less than LEVEL: 
7) The trace unit does not stall the processor. 
1 The trace unit can stall the processor. 
[7:4] 
Reserved, RESO. 
LEVEL, [3:2] 
Threshold level field. The field can support 4 monotonic levels from @b@@ to @b11, where: 
@bee@ Zero invasion. This setting has a greater risk of an ETM trace unit FIFO overflow. 
@b11 Maximum invasion occurs but there is less risk of a FIFO overflow. 
[1:0] 
Reserved, RESO. 


The TRCSTALLCTLR can be accessed through the external debug interface, offset @x@2c. 
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C11.10 Global Timestamp Control Register 
The TRCTSCTLR characteristics are: 


Purpose 
Controls the insertion of global timestamps in the trace streams. When the selected event is 
triggered, the trace unit inserts a global timestamp into the trace streams. The event is selected 
from one of the Resource Selectors. 

Usage constraints 
e Accepts writes only when the trace unit is disabled. 
e Must be programmed if TRCCONFIGR.TS==1. 


Configurations 
Available in all configurations. 
Attributes 
TRCTSCTLR is a 32-bit RW trace register. 


The register is set to an UNKNOWN value on a trace unit reset. See also C//./ ETM register 
summary on page C11-701. 


31 876 43 0 
me els 
L_ TYPE 


Figure C11-9 TRCTSCTLR bit assignments 


[31:8] 
Reserved, RESO 
TYPE, [7] 
Single or combined resource selector. 
[6:4] 
Reserved. 
SEL, [3:1] 
Identifies the resource selector to use. 


The TRCTSCTLR can be accessed through the external debug interface, offset 0x030. 
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C11.11 Synchronization Period Register 
The TRCSYNCPR characteristics are: 


Purpose 
Controls how often periodic trace synchronization requests occur. 

Usage constraints 
e You must always program this register as part of trace unit initialization. 
e Accepts writes only when the trace unit is disabled. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-10 TRCSYNCPR bit assignments 


[31:5] 
Reserved, RESO. 
PERIOD, [4:0] 
Defines the number of bytes of trace between synchronization requests as a total of the number 
of bytes generated by both the instruction and data streams. The number of bytes is 2N where N 
is the value of this field: 
e A value of zero disables these periodic synchronization requests, but does not disable other 
synchronization requests. 
¢ The minimum value that can be programmed, other than zero, is 8, providing a minimum 
synchronization period of 256 bytes. 
e The maximum value is 20, providing a maximum synchronization period of 27° bytes. 


The TRCSYNCPR can be accessed through the external debug interface, offset 0x034. 
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C11.12 Cycle Count Control Register 
The TRCCCCTLR characteristics are: 


Purpose 
Sets the threshold value for cycle counting. 
Usage constraints 
e Accepts writes only when the trace unit is disabled. 
e Must be programmed if TRCCONFIGR.CCI==1. 
e Minimum value that can be programmed is defined in TRCIDR3.CCITMIN. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-11 TRCCCCTLR bit assignments 


[31:12] 
Reserved, RESO. 
THRESHOLD, [11:0] 
Instruction trace cycle count threshold. 


The TRCCCCTLR can be accessed through the external debug interface, offset 0x038. 
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C11.13 Trace ID Register 
The TRCTRACEIDR characteristics are: 


Purpose 
Sets the trace ID for instruction trace. 

Usage constraints 
e You must always program this register as part of trace unit initialization. 
e Accepts writes only when the trace unit is disabled. 


Configurations 
Available in all configurations. 
Attributes 
TRCTRACEIDR is a 32-bit RW trace register. 


See C1l.] ETM register summary on page C11-701. 
31 7 6 0 


Figure C11-12 TRCTRACEIDR bit Assignments 


[31:7] 
Reserved, RESO. 
TRACEID, [6:0] 
Trace ID value. When only instruction tracing is enabled, this provides the trace ID. 


The TRCTRACEIDR can be accessed through the external debug interface, offset 0x040. 
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C11.14 Viewlinst Main Control Register 
The TRCVICTLR characteristics are: 


Purpose 
Controls instruction trace filtering. 
Usage constraints 
e Accepts writes only when the trace unit is disabled. 
e Returns stable data only when TRCSTATR.PMSTABLE==1. 
e Must be programmed, particularly to set the value of the SSSTATUS bit, that sets the state of 
the start-stop logic. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-13 TRCVICTLR bit assignments 


[31:24] 
Reserved, RESO. 

EXLEVEL NS, [23:20] 
In Non-secure state, each bit controls whether instruction tracing is enabled for the 
corresponding exception level: 


7) Trace unit generates instruction trace, in Non-secure state, for exception level n. 
1 Trace unit does not generate instruction trace, in Non-secure state, for exception level 
n. 


The exception levels are: 


Bit[20] Exception level 0. 
Bit[21] Exception level 1. 
Bit[22] Exception level 2. 
Bit[23] RAZ/WI. Instruction tracing is not implemented for exception level 3. 


EXLEVEL S, [19:16] 
In Secure state, each bit controls whether instruction tracing is enabled for the corresponding 
exception level: 
7) Trace unit generates instruction trace, in Secure state, for exception level n. 


1 Trace unit does not generate instruction trace, in Secure state, for exception level n. 


The exception levels are: 

Bit[16] Exception level 0. 

Bit[17] Exception level 1. 

Bit[18] RAZ/WI. Instruction tracing is not implemented for exception level 2. 
Bit[19] Exception level 3. 
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C11.14 Viewlnst Main Control Register 
[15:12] 
Reserved, RESO. 


TRCERR, [11] 
Selects whether a system error exception must always be traced: 


(3 System error exception is traced only if the instruction or exception immediately 
before the system error exception is traced. 


1 System error exception is always traced regardless of the value of ViewInst. 


TRCRESET, [10] 
Selects whether a reset exception must always be traced: 


(3 Reset exception is traced only if the instruction or exception immediately before the 
reset exception is traced. 
1 Reset exception is always traced regardless of the value of ViewInst. 


SSSTATUS, [9] 
Indicates the current status of the start/stop logic: 


7) Start/stop logic is in the stopped state. 

1 Start/stop logic is in the started state. 
[8] 

Reserved, RESO. 


TYPE, [7] 
Selects the resource type for the viewinst event: 


7) Single selected resource. 


1 Boolean combined resource pair. 


[6:4] 
Reserved, RESO. 
SEL, [3:0] 
Selects the resource number to use for the viewinst event, based on the value of TYPE: 


When TYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
The TRCVICTLR can be accessed through the external debug interface, offset 0x080. 
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C11.15 Viewlnst Include-Exclude Control Register 
The TRCVHECTLR characteristics are: 


Purpose 

Defines the address range comparators that control the ViewInst Include/Exclude control. 
Usage constraints 

e You must always program this register as part of trace unit initialization. 

e Accepts writes only when the trace unit is disabled. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-14 TRCVIIECTLR bit assignments 


[31:20] 
Reserved, RESO. 
EXCLUDE, [19:16] 
Defines the address range comparators for ViewInst exclude control. One bit is provided for 
each implemented Address Range Comparator. 
[15:4] 
Reserved, RESO. 
INCLUDE, [3:0] 
Defines the address range comparators for ViewInst include control. 


Selecting no include comparators indicates that all instructions must be included. The exclude 
control indicates which ranges must be excluded. 


One bit is provided for each implemented Address Range Comparator. 


The TRCVIECTLR can be accessed through the external debug interface, offset 0x084. 
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C11.16 Viewlnst Start-Stop Control Register 
The TRCVISSCTLR characteristics are: 


Purpose 

Defines the single address comparators that control the ViewInst Start/Stop logic. 
Usage constraints 

e You must always program this register as part of trace unit initialization. 

e Accepts writes only when the trace unit is disabled. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-15 TRCVISSCTLR bit assignments 


[31:24] 
Reserved, RESO. 
STOP, [23:16] 
Defines the single address comparators to stop trace with the ViewInst Start/Stop control. 


One bit is provided for each implemented single address comparator. 


[15:8] 
Reserved, RESO. 
START, [7:0] 
Defines the single address comparators to start trace with the ViewInst Start/Stop control. 


One bit is provided for each implemented single address comparator. 


The TRCVISSCTLR can be accessed through the external debug interface, offset 0x088. 
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C11.17 Sequencer State Transition Control Registers 0-2 
The TRCSEQEVRn characteristics are: 


Purpose 
Defines the sequencer transitions that progress to the next state or backwards to the previous 
state. The ETM trace unit implements a sequencer state machine with up to four states. 
Usage constraints 
e Accepts writes only when the trace unit is disabled. 
e Returns stable data only when TRCSTATR.PMSTABLE==1. 
¢ Software must use this register to set the initial state of the sequencer before the sequencer is 


used. 
Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-16 TRCSEQEVRn bit assignments 


[31:16] 
Reserved, RESO. 
B TYPE, [15] 
Selects the resource type to move backwards to this state from the next state: 


@ Single selected resource. 


1 Boolean combined resource pair. 


[14:12] 
Reserved, RESO 
B SEL, [11:8] 
Selects the resource number, based on the value of B TYPE: 


When B TYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When B TYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


F TYPE, [7] 
Selects the resource type to move forwards from this state to the next state: 


@ Single selected resource. 


1 Boolean combined resource pair. 


[6:4] 
Reserved, RESO. 
F SEL, [3:0] 
Selects the resource number, based on the value of F TYPE: 


When F TYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When F TYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
The TRCSEQEVRn registers can be accessed through the external debug interface, offsets: 


TRCSEQEVRO 
0x100. 
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TRCSEQEVRI 
0x104. 

TRCSEQEVR2 
0x18. 
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C11.18 Sequencer Reset Control Register 
The TRCSEQRSTEVR characteristics are: 


Purpose 
Resets the sequencer to state 0. 
Usage constraints 
e Accepts writes only when the trace unit is disabled. 
e Ifthe sequencer is used, you must program all sequencer state transitions with a valid event. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-17 TRCSEQRSTEVR bit assignments 


[31:8] 
Reserved, RESO. 
RESETTYPE, [7] 
Selects the resource type to move back to state 0: 
@ Single selected resource. 
1 Boolean combined resource pair. 
[6:4] 
Reserved, RESO. 


RESETSEL, [3:0] 
Selects the resource number, based on the value of RESETTYPE: 


When RESETTYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 


When RESETTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by 
bits[2:0]. 


The TRCSEQRSTEVR can be accessed through the external debug interface, offset 0x118. 
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C11.19 Sequencer State Register 
The TRCSEQSTR characteristics are: 


Purpose 
Holds the value of the current state of the sequencer. 
Usage constraints 
e Accepts writes only when the trace unit is disabled. 
e Returns stable data only when TRCSTATR.PMSTABLE==1. 
e Software must use this register to set the initial state of the sequencer before the sequencer is 


used. 
Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-18 TRCSEQSTR bit assignments 
[31:2] 


Reserved, RESO. 
STATE, [1:0] 

Current sequencer state: 

ebee State 0. 

@be1 State 1. 

b10 State 2. 

b11 State 3. 


The TRCSEQSTR can be accessed through the external debug interface, offset @x11c. 
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C11.20 External Input Select Register 
The TRCEXTINSELR characteristics are: 


Purpose 
Controls the selectors that choose an external input as a resource in the ETM trace unit. You can 
use the Resource Selectors to access these external input resources. 
Usage constraints 
Accepts writes only when the trace unit is disabled. 
Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-19 TRCEXTINSELR bit assignments 


[31:29] 

Reserved, RESO. 
SEL3, [28:24] 

Selects an event from the external input bus for External Input Resource 3. 
[23:21] 

Reserved, RESO. 
SEL2, [20:16] 

Selects an event from the external input bus for External Input Resource 2. 
[15:13] 

Reserved, RESO. 
SEL, [12:8] 

Selects an event from the external input bus for External Input Resource 1. 
[7:5] 

Reserved, RESO. 
SELO, [4:0] 

Selects an event from the external input bus for External Input Resource 0. 


The TRCEXTINSELR can be accessed through the external debug interface, offset 0x120. 
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C11.21 Counter Reload Value Registers 0-1 
The TRCCNTRLDVRn characteristics are: 


Purpose 
Defines the reload value for the counter. 
Usage constraints 
Accepts writes only when the trace unit is disabled. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 
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Figure C11-20 TRCCNTRLDVRno bit assignments 


[31:16] 
Reserved, RESO. 

VALUE, [15:0] 
Defines the reload value for the counter. This value is loaded into the counter each time the 
reload event occurs. 


The TRCCNTRLDVRn registers can be accessed through the external debug interface, offsets: 


TRCCNTRLDVRO 
0x140. 

TRCCNTRLDVRI 
0x144. 
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C11.22 Counter Control Register 0 
The TRCCNTCTLRO characteristics are: 


Purpose 
Controls the counter. 
Usage constraints 
Accepts writes only when the trace unit is disabled. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 
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Figure C11-21 TRCCNTCTLRO bit assignments 


[31:17] 
Reserved, RESO. 
RLDSELF, [16] 
Defines whether the counter reloads when it reaches zero: 


@ The counter does not reload when it reaches zero. The counter only reloads based on 
RLDTYPE and RLDSEL. 
1 The counter reloads when it reaches zero and the resource selected by CNTTYPE and 


CNTSEL is also active. The counter also reloads based on RLDTYPE and RLDSEL. 


RLDTYPE, [15] 
Selects the resource type for the reload: 
(3 Single selected resource. 


1 Boolean combined resource pair. 


[14:12] 
Reserved, RESO. 
RLDSEL, [11:8] 
Selects the resource number, based on the value of RLDTYPE: 


When RLDTYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When RLDTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


CNTTYPE, [7] 
Selects the resource type for the counter: 


(3 Single selected resource. 


1 Boolean combined resource pair. 


[6:4] 
Reserved, RESO. 
CNTSEL, [3:0] 
Selects the resource number, based on the value of CNTTYPE: 


When CNTTYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When CNTTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
The TRCCNTCTLRO can be accessed through the external debug interface, offset 0x150. 
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C11.23 Counter Control Register 1 
The TRCCNTCTLRI characteristics are: 


Purpose 
Controls the counter. 
Usage constraints 
Accepts writes only when the trace unit is disabled. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 
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Figure C11-22 TRCCNTCTLR1 bit assignments 


[31:18] 
Reserved, RESO. 

CNTCHAIN, [17] 
Defines whether the counter decrements when the counter reloads. This enables two counters to 
be used in combination to provide a larger counter: 


(3 The counter operates independently from the counter. The counter only decrements 
based on CNTTYPE and CNTSEL. 
1 The counter decrements when the counter reloads. The counter also decrements when 


the resource selected by CNTTYPE and CNTSEL is active. 


RLDSELF, [16] 
Defines whether the counter reloads when it reaches zero: 


(3 The counter does not reload when it reaches zero. The counter only reloads based on 
RLDTYPE and RLDSEL. 
1 The counter reloads when it is zero and the resource selected by CNTTYPE and 


CNTSEL is also active. The counter also reloads based on RLDTYPE and RLDSEL. 


RLDTYPE, [15] 
Selects the resource type for the reload: 


(3 Single selected resource. 


1 Boolean combined resource pair. 


[14:12] 
Reserved, RESO. 
RLDSEL, [11:8] 
Selects the resource number, based on the value of RLDTYPE: 


When RLDTYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When RLDTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 


CNTTYPE, [7] 
Selects the resource type for the counter: 


(3 Single selected resource. 
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C11 ETM registers 
C11.23 Counter Control Register 1 


1 Boolean combined resource pair. 


[6:4] 
Reserved, RESO. 
CNTSEL, [3:0] 
Selects the resource number, based on the value of CNTTYPE: 


When CNTTYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When CNTTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
The TRCCNTCTLRI can be accessed through the external debug interface, offset 0x154. 
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C11.24 Counter Value Registers 0-1 
The TRCCNTVRn characteristics are: 


Purpose 
Contains the current counter value. 
Usage constraints 
e Can be written only when the ETM trace unit is disabled. 
e The count value is stable only when TRCSTATR.PMSTABLE==1. 
e Ifsoftware uses counter <n>, then it must write to this register to set the initial counter value. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 


31 16 15 0 


Figure C11-23 TRCCNTVRn bit assignments 


[31:16] 
Reserved, RESO. 
VALUE, [15:0] 
Contains the current counter value. 


The TRCCNTVRn registers can be accessed through the external debug interface, offsets: 


TRCCNTVRO 
0x160. 
TRCCNTVRI 
0x164. 
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C11.25 ID Register 8 
The TRCIDR8 characteristics are: 


Purpose 
Returns the maximum speculation depth of the instruction trace stream. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 0 


MAXSPEC 


Figure C11-24 TRCIDR8 bit assignments 


MAXSPEC, [31:0] 
The maximum number of PO elements in the trace stream that can be speculative at any time. 


@ Maximum speculation depth of the instruction trace stream. 


The TRCIDR8 can be accessed through the external debug interface, offset 0x180. 
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C11.26 ID Register 9 
The TRCIDR9 characteristics are: 


Purpose 
Returns the number of PO right-hand keys that the trace unit can use. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See Cll.] ETM register summary on page C11-701. 


31 0 


NUMPOKEY 


Figure C11-25 TRCID9 bit assignments 


NUMPOKEY, [31:0] 
The number of PO right-hand keys that the trace unit can use. 


@ Number of PO right-hand keys. 


The TRCIDR9 can be accessed through the external debug interface, offset 0x184. 
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C11.27 ID Register 10 
The TRCIDR10 characteristics are: 


Purpose 
Returns the number of P1 right-hand keys that the trace unit can use. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 0 


NUMP1KEY 


Figure C11-26 TRCIDR10 bit assignments 


NUMPIKEY, [31:0] 
The number of P1 right-hand keys that the trace unit can use. 


© Number of P1 right-hand keys. 


The TRCIDR1O0 can be accessed through the external debug interface, offset 0x188. 
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C11.28 ID Register 11 
The TRCIDR11 characteristics are: 


Purpose 
Returns the number of special P1 right-hand keys that the trace unit can use. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 0 


NUMP1SPC 


Figure C11-27 TRCIDR11 bit assignments 


NUMPISPC, [31:0] 
The number of special P1 right-hand keys that the trace unit can use. 


© Number of special P1 right-hand keys. 


The TRCIDR11 can be accessed through the external debug interface, offset @x18C. 
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C11.29 ID Register 12 
The TRCIDR12 characteristics are: 


Purpose 
Returns the number of conditional instruction right-hand keys that the trace unit can use. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 0 


NUMCONDKEY 


Figure C11-28 TRCIDR12 bit assignments 


NUMCONDKEY, [31:0] 
The number of conditional instruction right-hand keys that the trace unit can use, including 
normal and special keys. 


© Number of conditional instruction right-hand keys. 


The TRCIDR12 can be accessed through the external debug interface, offset 0x199. 
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C11.30 ID Register 13 
The TRCIDR13 characteristics are: 


Purpose 
Returns the number of special conditional instruction right-hand keys that the trace unit can use. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 0 


NUMCONDSPC 


Figure C11-29 TRCIDR13 bit assignments 


NUMCONDSPC, [31:0] 
The number of special conditional instruction right-hand keys that the trace unit can use, 
including normal and special keys. 


@ Number of special conditional instruction right-hand keys. 


The TRCIDR13 can be accessed through the external debug interface, offset 0x194. 
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C11.31 Implementation Specific Register 0 
The TRCIMSPECO characteristics are: 


Purpose 
Shows the presence of any implementation specific features, and enables any features that are 
provided. 

Usage constraints 
There are no usage constraints. 


Configurations 
Available in all configurations. 
Attributes 
See Cll.] ETM register summary on page C11-701. 
31 4 3 0 
mid 
ae 


Figure C11-30 TRCIMSPECO bit assignments 


[31:4] 
Reserved, RESO. 
SUPPORT, [3:0] 


@ No implementation specific extensions are supported. 


The TRCIMSPECO can be accessed through the external debug interface, offset @x1C@. 
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C11.32 ID Register 0 


ID Register 0 


The TRCIDRO characteristics are: 


Purpose 
Returns the tracing capabilities of the ETM trace unit. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 
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Figure C11-31 TRCIDRO bit assignments 


[31:30] 
Reserved, RESO. 
COMMOPT, [29] 
Indicates the meaning of the commit field in some packets: 


1 Commit mode 1. 


TSSIZE, [28:24] 
Global timestamp size field: 


@be10ee@ Implementation supports a maximum global timestamp of 64 bits. 
[23:17] 
Reserved, RESO. 


QSUPP, [16:15] 
Indicates Q element support: 


@bee Q elements not supported. 


QFILT, [14] 
Indicates Q element filtering support: 


@be Q element filtering not supported. 


CONDTYPE, [13:12] 
Indicates how conditional results are traced: 


@bee Conditional trace not supported. 


NUMEVENT, [11:10] 
Number of events supported in the trace, minus 1: 


@b11 Four events supported. 


RETSTACK, [9] 
Return stack support: 


1 Return stack implemented. 
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C11.32 ID Register 0 


[8] 
Reserved, RESO. 
TRCCCI, [7] 
Support for cycle counting in the instruction trace: 


1 Cycle counting in the instruction trace is implemented. 
TRCCOND, [6] 

Support for conditional instruction tracing: 

(3 Conditional instruction tracing is not supported. 
TRCBB, [5] 

Support for branch broadcast tracing: 

1 Branch broadcast tracing is implemented. 
TRCDATA, [4:3] 

Conditional tracing field: 

@bee Tracing of data addresses and data values is not implemented. 
INSTPO, [2:1] 

PO tracing support field: 

@bee Tracing of load and store instructions as PO elements is not supported. 
[0] 

Reserved, RESI. 


The TRCIDRO can be accessed through the external debug interface, offset @x1E@. 
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ID Register 1 


The TRCIDR1 characteristics are: 


Purpose 
Returns the base architecture of the trace unit. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 24 23 16 15 12 11 8 
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TRCARCHMAJ — 
TRCARCHMIN 
Figure C11-32 TRCIDR1 bit assignments 


DESIGNER, [31:24] 
Indicates which company designed the trace unit: 
0x41 ARM. 
[23:16] 
Reserved, RESO. 
[15:12] 
Reserved, RESI. 


TRCARCHMAJ, [11:8] 
Major trace unit architecture version number: 


ebe10e ETMv4. 


TRCARCHMIN, [7:4] 
Minor trace unit architecture version number: 


@beeee@ Minor revision 0. 


REVISION, [3:0] 
Implementation revision number: 


@x2 r0p2. 


The TRCIDRI can be accessed through the external debug interface, offset @x1E4. 
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C11.34 ID Register 2 
The TRCIDR2 characteristics are: 


Purpose 
Returns the maximum size of the following parameters in the trace unit: 
e Cycle counter. 
e Data value. 
e Data address. 
e VMID. 
* Context ID. 
e Instruction address. 


Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-33 TRCIDR2 bit assignments 


[31:29] 
Reserved, RESO. 
CCSIZE, [28:25] 
Size of the cycle counter in bits minus 12: 


exe The cycle counter is 12 bits in length. 


DVSIZE, [24:20] 
Data value size in bytes: 


@xee@ Data value tracing is not implemented. 


DASIZE, [19:15] 
Data address size in bytes: 


@xe@ Data address tracing is not implemented. 


VMIDSIZE, [14:10] 
Virtual Machine ID size: 


@x1 Virtual Machine ID is 8 bits. 


CIDSIZE, [9:5] 
Context ID size in bytes: 


0x4 Maximum of 32-bit Context ID size. 


IASIZE, [4:0] 
Instruction address size in bytes: 


0x8 Maximum of 64-bit address size. 


The TRCIDR2 can be accessed through the external debug interface, offset 0x1E8. 
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C11.35 ID Register 3 
The TRCIDR3 characteristics are: 


Purpose 
Indicates: 
e Whether TRCVICTLR is supported. 
¢ The number of cores available for tracing. 
e Ifan exception level supports instruction tracing. 
¢ The minimum threshold value for instruction trace cycle counting. 
e Whether the synchronization period is fixed. 
e Whether TRCSTALLCTLR is supported and if so whether it supports trace overflow 
prevention and supports stall control of the processor. 


Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 


3130 28 27 26 25 24 23 20 19 16 15 12 11 5 4 0 


fit TTT 
L EXLEVEL_S 

EXLEVEL_NS 

TRCERR 

SYNCPR 

STALLCTL 

SYSSTALL 


NUMPROC 
NOOVERFLOW 


























Figure C11-34 TRCIDR3 bit assignments 


NOOVERFLOW, [31] 
Indicates whether TRCSTALLCTLR.NOOVERFLOW is implemented: 


(3 TRCSTALLCTLR.NOOVERFLOW is not implemented. 


NUMPROC, [30:28] 
Indicates the number of cores available for tracing: 


@beee = The trace unit can trace one processor, ETM trace unit sharing not supported. 


SYSSTALL, [27] 
Indicates whether stall control is implemented: 


1 The system supports processor stall control. 


STALLCTL, [26] 
Indicates whether TRCSTALLCTLR is implemented: 


1 TRCSTALLCTLR is implemented. 


This field is used in conjunction with SYSSTALL. 


SYNCPR, [25] 
Indicates whether there is a fixed synchronization period: 


(2) TRCSYNCPR is read-write so software can change the synchronization period. 
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TRCERR, [24] 
Indicates whether TRCVICTLR.TRCERR is implemented: 
1 TRCVICTLR.TRCERR is implemented. 


EXLEVEL _NS, [23:20] 
Each bit controls whether instruction tracing in Non-secure state is implemented for the 
corresponding exception level: 


@b@111 Instruction tracing is implemented for Non-secure ELO, EL1 and EL2 exception levels. 


EXLEVEL S, [19:16] 
Each bit controls whether instruction tracing in Secure state is implemented for the 
corresponding exception level: 


@b1011 Instruction tracing is implemented for Secure ELO, EL1 and EL3 exception levels. 
[15:12] 
Reserved, RESO. 


CCITMIN, [11:0] 
The minimum value that can be programmed in TRCCCCTLR.THRESHOLD: 


@xee4 Instruction trace cycle counting minimum threshold is 4. 


The TRCIDR3 can be accessed through the external debug interface, offset @x1EC. 
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ID Register 4 


The TRCIDR4 characteristics are: 


Purpose 
Indicates the resources available in the ETM trace unit. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See Cll.] ETM register summary on page C11-701. 
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Figure C11-35 TRCIDR4 bit assignments 


NUMVMIDC, [31:28] 
Indicates the number of VMID comparators available for tracing: 


0x1 One VMID comparator is available. 


NUMCIDC, [27:24] 
Indicates the number of CID comparators available for tracing: 


0x1 One Context ID comparator is available. 


NUMSSCC, [23:20] 
Indicates the number of single-shot comparator controls available for tracing: 


0x1 One single-shot comparator control is available. 


NUMRSPAIR, [19:16] 
Indicates the number of resource selection pairs available for tracing: 


0x7 Eight resource selection pairs are available. 


NUMPC, [15:12] 
Indicates the number of processor comparator inputs available for tracing: 
exe Processor comparator inputs are not implemented. 

[11:9] 


Reserved, RESO. 
SUPPDAC, [8] 


Indicates whether the implementation supports data address comparisons: This value is: 


(3 Data address comparisons are not implemented. 


NUMDVC, [7:4] 
Indicates the number of data value comparators available for tracing: 


exe Data value comparators not implemented. 


NUMACPPAIRS, [3:0] 
Indicates the number of address comparator pairs available for tracing: 


0x4 Four address comparator pairs are implemented. 


The TRCIDR4 can be accessed through the external debug interface, offset 0x1F®. 





ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights 


reserved. 
Non-Confidential 


C11-746 


C11 ETM registers 
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ID Register 5 


The TRCIDRS characteristics are: 


Purpose 
Returns how many resources the trace unit supports. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 
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Figure C11-36 TRCIDRS bit assignments 


REDFUNCNTR, [31] 
Reduced Function Counter implemented: 


(3 Reduced Function Counter not implemented. 
NUMCCNTR, [30:28] 

Number of counters implemented: 

b010 Two counters implemented. 
NUMSEQSTATE, [27:25] 

Number of sequencer states implemented: 

@b10@ Four sequencer states implemented. 
[24] 

Reserved, RESO. 


LPOVERRIDE, [23] 
Low-power state override support: 


1 Low-power state override support implemented. 
ATBTRIG, [22] 

ATB trigger support: 

1 ATB trigger support implemented. 


TRACEIDSIZE, [21:16] 
Number of bits of trace ID: 


@x@7 Seven-bit trace ID implemented. 
[15:12] 
Reserved, RESO. 


NUMEXTINSEL, [11:9] 
Number of external input selectors implemented: 


@b1e@ Four external input selectors implemented. 
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NUMEXTIN, [8:0] 
Number of external inputs implemented: 


®x1E 30 external inputs implemented. 


The TRCIDRS can be accessed through the external debug interface, offset @x1F4. 
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C11.38 Resource Selection Control Registers 2-16 
The TRCRSCTLRn characteristics are: 


Purpose 
Controls the trace resources. 


There are eight resource pairs, the first pair is predefined as {0,1,pair=0} and having reserved 
select registers. This leaves seven pairs to be implemented as programmable selectors. 


Usage constraints 

Accepts writes only when the trace unit is disabled. 
Configurations 

Available in all configurations. 
Attributes 

See C1l.] ETM register summary on page C11-701. 
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Figure C11-37 TRCRSCTLRn bit assignments 


[31:22] 
Reserved, RESO. 
PAIRINY, [21] 
Inverts the result of a combined pair of resources. 


This bit is implemented only on the lower register for a pair of resource selectors. 


INV, [20] 
Inverts the selected resources: 


(7) Resource is not inverted. 
1 Resource is inverted. 


[19] 
Reserved, RESO. 

GROUP, [18:16] 
Selects a group of resources. See the ARM ETM Architecture Specification, ETMv4 for more 
information. 

[15:8] 
Reserved, RESO. 

SELECT, [7:0] 
Selects one or more resources from the required group. One bit is provided for each resource 
from the group. 


The TRCRSCTLRn can be accessed through the external debug interface, offset @x208-@23C. 
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C11.39 Single-Shot Comparator Control Register 0 
The TRCSSCCRO characteristics are: 


Purpose 
Controls the single-shot comparator. 
Usage constraints 
Accepts writes only when the trace unit is disabled. 


Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 
31 25 24 23 20 19 16 15 8 7 0 
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Figure C11-38 TRCSSCCRO bit assignments 


[31:25] 
Reserved, RESO. 

RST, [24] 
Enables the single-shot comparator resource to be reset when it occurs, to enable another 
comparator match to be detected: 


1 Reset enabled. Multiple matches can occur. 
[23:20] 
Reserved, RESO. 


ARC, [19:16] 
Selects one or more address range comparators for single-shot control. 


One bit is provided for each implemented address range comparator. 


[15:8] 
Reserved, RESO. 
SAC, [7:0] 
Selects one or more single address comparators for single-shot control. 


One bit is provided for each implemented single address comparator. 


The TRCSSCCRO can be accessed through the external debug interface, offset 0x280. 
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C11.40 Single-Shot Comparator Status Register 0 
The TRCSSCSRO characteristics are: 


Purpose 
Indicates the status of the single-shot comparator. TRCSSCSR0 is sensitive to instruction 
addresses. 

Usage constraints 


e Accepts writes only when the trace unit is disabled. 
e The STATUS bit value is stable only when TRCSTATR.PMSTABLE==1. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
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Figure C11-39 TRCSSCSRO bit assignments 


STATUS, [31] 
Single-shot status. This indicates whether any of the selected comparators have matched: 


@ Match has not occurred. 


1 Match has occurred at least once. 


When programming the ETM trace unit, if TRCSSCCRn.RST is b0, the STATUS bit must be 
explicitly written to 0 to enable this single-shot comparator control. 


[30:3] 
Reserved, RESO. 
DV, [2] 
Data value comparator support: 


@ Single-shot data value comparisons not supported. 
DA, [1] 

Data address comparator support: 

@ Single-shot data address comparisons not supported. 
INST, [0] 

Instruction address comparator support: 


1 Single-shot instruction address comparisons supported. 


The TRCSSCSRO can be accessed through the external debug interface, offset @x2A@. 
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C11.41 OS Lock Access Register 

The TRCOSLAR characteristics are: 

Purpose 
Sets and clears the OS Lock, to lock out external debugger accesses to the ETM trace unit 
registers. 

Usage constraints 
There are no usage constraints. 

Configurations 
Available in all configurations. 

Attributes 
See C1l.] ETM register summary on page C11-701. 
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Figure C11-40 TRCOSLAR bit assignments 


[31:1] 
TRCRSCTLRN 
OSLK, [0] 
OS Lock key value: 


(7) Unlock the OS Lock. 
1 Lock the OS Lock. 


The TRCOSLAR can be accessed through the external debug interface, offset 0x300. 
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C11.42 OS Lock Status Register 


The TRCOSLSR characteristics are: 


Purpose 
Returns the status of the OS Lock. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 
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Figure C11-41 TRCOSLSR bit assignments 


[31:4] 
TRCRSCTLRN 

OSLM[1], [3] 
OS Lock model [1] bit. This bit is combined with OSLM[0] to form a two-bit field that indicates 
the OS Lock model is implemented. 


The value of this field is always @b18, indicating that the OS Lock is implemented. 


nTT, [2] 
This bit is RAZ, that indicates that software must perform a 32-bit write to update the 
TRCOSLAR. 
OSLK, [1] 
OS Lock status bit: 
(3 OS Lock is unlocked. 
1 OS Lock is locked. 
OSLM[0], [0] 
OS Lock model [0] bit. This bit is combined with OSLM[1] to form a two-bit field that indicates 
the OS Lock model is implemented. 


The value of this field is always b19, indicating that the OS Lock is implemented. 
The TRCOSLSR can be accessed through the external debug interface, offset @x304. 
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C11 ETM registers 
C11.43 Power Down Control Register 


C11.43 Power Down Control Register 
The TRCPDCR characteristics are: 


Purpose 

Request to the system power controller to keep the ETM trace unit powered up. 
Usage constraints 

There are no usage constraints. 


Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 
31 4 3 2 0 
em | 
Pu— 


Figure C11-42 TRCPDCR bit assignments 


[31:4] 
Reserved, RESO. 

PU, [3] 
Powerup request, to request that power to the ETM trace unit and access to the trace registers is 
maintained: 


(3 Power not requested. 
1 Power requested. 


This bit is reset to 0 on a trace unit reset. 


[2:0] 
Reserved, RESO. 


The TRCPDCR can be accessed through the external debug interface, offset 0x310. 
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C11 ETM registers 
C11.44 Power Down Status Register 


C11.44 Power Down Status Register 
The TRCPDSR characteristics are: 


Purpose 
Indicates the power down status of the ETM trace unit. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 6 5 4 2 1 0 


OsLK— 
STICKYPD 
POWER 


Figure C11-43 TRCPDSR bit assignments 


[31:6] 
Reserved, RESO. 
OSLK, [5] 
OS lock status. 
(7) The OS Lock is unlocked. 
1 The OS Lock is locked. 
[4:2] 


Reserved, RESO. 
STICKYPD, [1] 
Sticky power down state. 


(3 Trace register power has not been removed since the TRCPDSR was last read. 
1 Trace register power has been removed since the TRCPDSR was last read. 


This bit is set to 1 when power to the ETM trace unit registers is removed, to indicate that 
programming state has been lost. It is cleared after a read of the TRCPDSR. 


POWER, [0] 
Indicates the ETM trace unit is powered: 


(3 ETM trace unit is not powered. The trace registers are not accessible and they all 
return an error response. 


1 ETM trace unit is powered. All registers are accessible. 


If a system implementation allows the ETM trace unit to be powered off independently of the 
debug power domain, the system must handle accesses to the ETM trace unit appropriately. 


The TRCPDSR can be accessed through the external debug interface, offset 0x314. 
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C11 ETM registers 
C11.45 Address Comparator Value Registers 0-7 


C11.45 Address Comparator Value Registers 0-7 
The TRCACVRn characteristics are: 


Purpose 

Indicates the address for the address comparators. 
Usage constraints 

Accepts writes only when the trace unit is disabled. 
Configurations 

Available in all configurations. 
Attributes 

See C1l.] ETM register summary on page C11-701. 


63 0 


ADDRESS 


Figure C11-44 TRCACVRn bit assignments 


ADDRESS, [63:0] 
The address value to compare against. 


The TRCACVRn can be accessed through the external debug interface, offset @x4@0-0x43C. 
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C11 ETM registers 
C11.46 Address Comparator Access Type Registers 0-7 


C11.46 Address Comparator Access Type Registers 0-7 
The TRCACATRn characteristics are: 


Purpose 
Controls the access for the corresponding address comparators. 
Usage constraints 

e Accepts writes only when the trace unit is disabled. 

e If software uses two single address comparators as an address range comparator then it must 
program the corresponding TRCACATR registers with identical values in the following 
fields: 

— TYPE 

— CONTEXTTYPE 
— EXLEVEL S 

— EXLEVEL NS 


Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


63 16 15 12 11 8 3210 


7 
— = || lF 
EXLEVEL_NS— CONTEXTTYPE— 
EXLEVEL_S 
Figure C11-45 TRCACATRnh bit assignments 


[63:16] 
Reserved, RESO. 

EXLEVEL_NS, [15:12] 
Each bit controls whether a comparison can occur in Non-secure state for the corresponding 
exception level. The possible values are: 


(3 The trace unit can perform a comparison, in Non-secure state, for exception level n. 
1 The trace unit does not perform a comparison, in Non-secure state, for exception level 
n. 


The exception levels are: 


Bit[12] Exception level 0. 
Bit[13] Exception level 1. 
Bit[14] Exception level 2. 
Bit[15] Always Reso. 
EXLEVEL S, [11:8] 


Each bit controls whether a comparison can occur in Secure state for the corresponding 
exception level. The possible values are: 


(3 The trace unit can perform a comparison, in Secure state, for exception level n. 


1 The trace unit does not perform a comparison, in Secure state, for exception level n. 


The exception levels are: 
Bit[8] Exception level 0. 
Bit[9] Exception level 1. 
Bit[10] Always Reso. 
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C11 ETM registers 
C11.46 Address Comparator Access Type Registers 0-7 


Bit[11] Exception level 3. 


[7:4] 


Reserved, RESO. 
Context type, [3:2] 
Controls whether the trace unit performs a Context ID comparison, a VMID comparison, or both 


comparisons: 

@bee The trace unit does not perform a Context ID comparison. 

@be1 The trace unit performs a Context ID comparison using the Context ID comparator 
that the CONTEXT field specifies, and signals a match if both the Context ID 
comparator matches and the address comparator match. 

@b1@ The trace unit performs a VMID comparison using the VMID comparator that the 
CONTEXT field specifies, and signals a match if both the VMID comparator and the 
address comparator match. 

@b11 The trace unit performs a Context ID comparison and a VMID comparison using the 
comparators that the CONTEXT field specifies, and signals a match if the Context ID 
comparator matches, the VMID comparator matches, and the address comparator 
matches. 

Type, [1:0] 


The type of comparison: 


e@bee 


Instruction address, RESO. 


The TRCACATR=a can be accessed through the external debug interface, offset 0x480-0x4B8. 
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C11.47 Context ID Comparator Value Register 0 


The TRCCIDCVR0O characteristics are: 


Purpose 
Contains a Context ID value. 
Usage constraints 
Accepts writes only when the trace unit is disabled. 
Configurations 
Available in all configurations. 
Attributes 


See C1l.] ETM register summary on page C11-701. 


63 32 31 


C11 ETM registers 
C11.47 Context ID Comparator Value Register 0 





Context ID Value 


Figure C11-46 TRCCIDCVRO bit assignments 


[63:32] 
Reserved, RESO. 
VALUE, [31:0] 
The data value to compare against. 


The TRCCIDCVRO can be accessed through the external debug interface, offset 0x600. 
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C11 ETM registers 
C11.48 VMID Comparator Value Register 0 


C11.48 VMID Comparator Value Register 0 
The TRCVMIDCVRO characteristics are: 


Purpose 
Contains a VMID value. 
Usage constraints 
Accepts writes only when the trace unit is disabled. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


63 8 7 0 


RESO VALUE 


Figure C11-47 TRCVMIDCVRO bit assignments 


[63:8] 

Reserved, RESO. 
VALUE, [7:0] 

The VMID value. 


The TRCVMIDCVRO can be accessed through the external debug interface, offset 0x640. 
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C11 ETM registers 
C11.49 Context ID Comparator Control Register 0 


C11.49 Context ID Comparator Control Register 0 
The TRCCIDCCTLRO characteristics are: 


Purpose 
Controls the mask value for the context ID comparators. 
Usage constraints 
e Accepts writes only when the trace unit is disabled. 
e Ifsoftware uses the TRCCIDCVRn registers, where n=0 to 3, then it must program this 
register. 
e Ifsoftware sets a mask bit to 1 then it must program the relevant byte in TRCCIDCVRn to 
0x00. 


Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 4 3 0 


Figure C11-48 TRCCIDCCTLRO bit assignments 


[31:4] 
Reserved, RESO. 
COMPO, [3:0] 
Controls the mask value that the trace unit applies to TRCCIDCVRO. Each bit in this field 
corresponds to a byte in TRCCIDCVRO. When a bit is: 
© The trace unit includes the relevant byte in TRCCIDCVRO when it performs the Context ID 
comparison. 
1 The trace unit ignores the relevant byte in TRCCIDCVRO when it performs the Context ID 
comparison. 


The TRCCIDCCTLRO can be accessed through the external debug interface, offset 0x680. 
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C11 ETM registers 
C11.50 Integration ATB Identification Register 


C11.50 Integration ATB Identification Register 
The TRCITATBIDR characteristics are: 


Purpose 
Sets the state of output pins shown in the following table. 
Usage constraints 
e Available when bit[0] of TRCITCTRL is set to 1. 
e The value of the register sets the signals on the output pins when the register is written. 


Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 7 6 0 


em | e 


Figure C11-49 TRCITATBIDR bit assignments 


[31:7] 
Reserved. Read undefined. 
ID, [6:0] 
Drives the ATIDMn{[6:0] output pins. 


When a bit is set to 0, the corresponding output pin is LOW. 

When a bit is set to 1, the corresponding output pin is HIGH. 

The TRCITATBIDR bit values correspond to the physical state of the output pins. 
The TRCITATBIDR can be accessed through the external debug interface, offset @xEE4. 
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C11 ETM registers 
C11.51 Integration Instruction ATB Data Register 


C11.51 Integration Instruction ATB Data Register 
The TRCITIDATAR characteristics are: 


Purpose 
Sets the state of the ATDATAMnh output pins shown in the following table. 
Usage constraints 
e Available when bit[0] of TRCITCTRL is set to 1. 
e The value of the register sets the signals on the output pins when the register is written. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 


31 5 43 2 1 0 


ATDATAM[31] =| 
ATDATAM[23] 


ATDATAM[15] 
ATDATAM[7] 
ATDATAM[0] 





Figure C11-50 TRCITIDATAR bit assignments 


For all non-reserved bits: 

e When a bit is set to 0, the corresponding output pin is LOW. 

e When a bit is set to 1, the corresponding output pin is HIGH. 

e The TRCITDDATAR bit values correspond to the physical state of the output pins. 


[31:5] 
Reserved, RESO. 
ATDATAM[31], [4] 
Drives the ATDATAMJ]31] output. 
ATDATAM[23], [3] 
Drives the ATDATAM]23] output. 
ATDATAM[I15], [2] 
Drives the ATDATAM[15] output. 
ATDATAM[7], [1] 
Drives the ATDATAM][7] output. 
ATDATAM/[O], [0] 
Drives the ATDATAM[0] output. 


The TRCITIDATAR can be accessed through the external debug interface, offset @xEEC. 
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C11 ETM registers 
C11.52 Integration Instruction ATB In Register 


C11.52 Integration Instruction ATB In Register 
The TRCITIATBINR characteristics are: 


Purpose 
Reads the state of the input pins shown in the following table. 
Usage constraints 
e Available when bit[0] of TRCITCTRL is set to 1. 
e The values of the register bits depend on the signals on the input pins when the register is 
read. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 


31 2 1 0 


emt O 
AFVALIDM 
ATREADYM 


Figure C11-51 TRCITIATBINR bit assignments 


For all non-reserved bits: 

e When an input pin is LOW, the corresponding register bit is 0. 

e When an input pin is HIGH, the corresponding register bit is 1. 

e The TRCITIATBINR bit values always correspond to the physical state of the input pins. 


[31:2] 

Reserved. Read undefined. 
AFVALIDM, [1] 

Returns the value of the AFVALIDMn input pin. 
ATREADYM, [0] 

Returns the value of the ATREADYMn input pin. 


The TRCITIATBINR can be accessed through the external debug interface, offset @xEF4. 
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C11 ETM registers 
C11.53 Integration Instruction ATB Out Register 


C11.53 Integration Instruction ATB Out Register 
The TRCITIATBOUTR characteristics are: 


Purpose 
Sets the state of the output pins shown in the following table. 
Usage constraints 
e Available when bit[0] of TRCITCTRL is set to 1. 
e The value of the register sets the signals on the output pins when the register is written. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 


31 109 8 7 2 1 0 


pytes— AFREADY 
ATVALID 


Figure C11-52 TRCITIATBOUTR bit assignments 


For all non-reserved bits: 

e When a bit is set to 0, the corresponding output pin is LOW. 

e When a bit is set to 1, the corresponding output pin is HIGH. 

e The TRCITIATBOUTR bit values always correspond to the physical state of the output pins. 


[31:10] 

Reserved. Read undefined. 
BYTES, [9:8] 

Drives the ATBYTESMn[1:0] output pins. 
[7:2] 

Reserved. Read undefined. 
AFREADY, [1] 

Drives the AFREADYMn output pin. 
ATVALID, [0] 

Drives the ATVALIDMn output pin. 


The TRCITIATBOUTR can be accessed through the external debug interface, offset @xEFC. 
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C11 ETM registers 
C11.54 Integration Mode Control Register 


C11.54 Integration Mode Control Register 
The TRCITCTRL characteristics are: 


Purpose 
Enables topology detection or integration testing, by putting the ETM trace unit into integration 
mode. 

Usage constraints 
ARM recommends that you perform a debug reset after using integration mode. 


Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 
31 1 0 
a S O 
IME | 


Figure C11-53 TRCITCTRL bit assignments 


[31:1] 
Reserved, RESO. 
IME, [0] 
Integration mode enable bit. The possible values are: 
© The trace unit is not in integration mode. 
1 The trace unit is in integration mode. This mode enables: 


e A debug agent to perform topology detection. 
e SoC test software to perform integration testing. 


The TRCITCTRL can be accessed through the external debug interface, offset @xFee. 
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C11 ETM registers 
C11.55 Claim Tag Set Register 


C11.55 Claim Tag Set Register 
The TRCCLAIMSET characteristics are: 


Purpose 
Sets bits in the claim tag and determines the number of claim tag bits implemented. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 4 3 0 


Figure C11-54 TRCCLAIMSET bit assignments 


[31:4] 
Reserved, RESO. 
SET, [3:0] 
On reads, for each bit: 


© Claim tag bit is not implemented. 
1 Claim tag bit is implemented. 

On writes, for each bit: 

© Has no effect. 


1 Sets the relevant bit of the claim tag. 


The TRCCLAIMSET can be accessed through the external debug interface, offset @xFAQ. 
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C11 ETM registers 
C11.56 Claim Tag Clear Register 


C11.56 Claim Tag Clear Register 
The TRCCLAIMCLR characteristics are: 


Purpose 
Clears bits in the claim tag and determines the current value of the claim tag. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 4 3 0 


Figure C11-55 TRCCLAIMCLR bit assignments 


[31:4] 
Reserved, RESO. 
CLR, [3:0] 
On reads, for each bit: 


(3 Claim tag bit is not set. 

1 Claim tag bit is set. 

On writes, for each bit: 

(3 Has no effect. 

1 Clears the relevant bit of the claim tag. 


The TRCCLAIMCLR can be accessed through the external debug interface, offset @xFA4. 
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C11 ETM registers 
C11.57 Device Affinity Register 0 


C11.57 Device Affinity Register 0 
The TRCDEVAFFO characteristics are: 


Purpose 
Provides an additional core identification mechanism for scheduling purposes in a cluster. 


TRCDEVAFFO is a read-only copy of MPIDR accessible from the external debug interface. 


Usage constraints 
This register is accessible as follows: 



































ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 
Configurations 
The TRCDEVAFF is: 


e Architecturally mapped to the AArch64 MPIDR_EL1[31:0] register. See B2.83 Main ID 
Register, ELI on page B2-492. 
e Architecturally mapped to external TRCDEVAFFO register. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes 
TRCDEVAFFO is a 32-bit register. 
31 30 29 25 24 23 16 15 8 7 0 
MT— 


Figure C11-56 TRCDEVAFFO bit assignments 


M, [31] 
Reserved, RESI. 
U, [30] 

Indicates a single core system, as distinct from core 0 in a cluster. This value is: 

(3 Processor is part of a multiprocessor system. This is the value for implementations 
with more than one core, and for implementations with an ACE or CHI master 
interface. 

1 Processor is part of a uniprocessor system. This is the value for single core 


implementations with an AXI master interface. 


[29:25] 
Reserved, RESO. 

MT, [24] 
Indicates whether the lowest level of affinity consists of logical cores that are implemented 
using a multi-threading type approach. This value is: 


(2) Performance of cores at the lowest affinity level is largely independent. 


Aff2, [23:16] 
Affinity level 2. Second highest level affinity field. 


Indicates the value read in the CLUSTERIDAFF?2 configuration signal. 
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Aff1, [15:8] 
Affinity level 1. Third highest level affinity field. 


Indicates the value read in the CLUSTERIDAFF1 configuration signal. 


Aff0, [7:0] 
Affinity level 0. Lowest level affinity field. 


C11 ETM registers 
C11.57 Device Affinity Register 0 


Indicates the core number in the Cortex-A35 processor. The possible values are: 


exe A processor with one core only. 
xð, @x1 A cluster with two cores. 

@x®, 0x1, 0x2 A cluster with three cores. 

@x®, 0x1, 0x2, 0x3 A cluster with four cores. 


To access the TRCDEVAFFO: 
MRC p15,0,<Rt>,c@,c@,5 ; Read TRCDEVAFF®@ into Rt 


Register access is encoded as follows: 


Table C11-2 TRCDEVAFFO access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0000 | 0000 | 101 
The TRCDEVAFFO0 can be accessed through the external debug interface, offset @xFA8. 
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C11 ETM registers 
C11.58 Device Affinity Register 1 


C11.58 Device Affinity Register 1 
The TRCDEVAFF!1 characteristics are: 


Purpose 
The value is a read-only copy of MPIDR_EL1[63:32] as seen from EL3, unaffected by 
VMPIDR_EL2. 
Usage constraints 
Accessible only from the external debug interface. 
Configurations 
Available in all configurations. 
Attributes 
TRCDEVAFF1 is a 32-bit RO management register. 


For the Cortex-A35 processor, MPIDR_EL1[63:32] is REso. 
See C1l.] ETM register summary on page C11-701. 
The TRCDEVAFF1 can be accessed through the external debug interface, offset @xFAC. 
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C11 ETM registers 
C11.59 Software Lock Access Register 


C11.59 Software Lock Access Register 
The TRCLAR characteristics are: 


Purpose 
Controls access to registers using the memory-mapped interface, when PADDRDBG31 is 
LOW. 


When the software lock is set, write accesses using the memory-mapped interface to all ETM 
trace unit registers are ignored, except for write accesses to the TRCLAR. 


When the software lock is set, read accesses of TRCPDSR do not change the 
TRCPDSR.STICKYPD bit. Read accesses of all other registers are not affected. 


Usage constraints 
Accessible only from the memory-mapped interface. 


Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 
31 0 
KEY 


Figure C11-57 TRCLAR bit assignments 


KEY, [31:0] 
Software lock key value: 


@xC5ACCE55 Clear the software lock. 
All other write values set the software lock. 


The TRCLAR can be accessed through the external debug interface, offset @xFB@. 
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C11 ETM registers 
C11.60 Software Lock Status Register 


C11.60 Software Lock Status Register 

The TRCLSR characteristics are: 

Purpose 
Determines whether the software lock is implemented, and indicates the current status of the 
software lock. 

Usage constraints 
Accessible only from the external debug interface. 

Configurations 
Available in all configurations. 


Attributes 
See C1l.] ETM register summary on page C11-701. 


Figure C11-58 TRCLSR bit assignments 


[31:3] 
Reserved, RESO. 
nTT, [2] 
Indicates size of TRCLAR: 


(3 TRCLAR is always 32 bits. 
SLK, [1] 

Software lock status: 

(2) Software lock is clear. 


1 Software lock is set. 


SLI, [0] 
Indicates whether the software lock is implemented on this interface. 


1 Software lock is implemented on this interface. 


The TRCLSR can be accessed through the external debug interface, offset @xFB4. 
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C11 ETM registers 
C11.61 Authentication Status Register 


C11.61 Authentication Status Register 
The TRCAUTHSTATUS characteristics are: 


Purpose 
Indicates the current level of tracing permitted by the system. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 


SNID 
SID 


NSNID 
NSID 





Figure C11-59 TRCAUTHSTATUS bit assignments 


[31:8] 
Reserved, RESO. 
SNID, [7:6] 
Secure Non-invasive Debug: 


@b1@ Secure Non-invasive Debug implemented but disabled. 
@b11 Secure Non-invasive Debug implemented and enabled. 
SID, [5:4] 
Secure Invasive Debug: 
@bee@ Secure Invasive Debug is not implemented. 
NSNID, [3:2] 
Non-secure Non-invasive Debug: 
@b1@ Non-secure Non-invasive Debug implemented but disabled, NIDEN=0. 
@b11 Non-secure Non-invasive Debug implemented and enabled, NIDEN=1. 


NSID, [1:0] 
Non-secure Invasive Debug: 


Əbðð  Non-secure Invasive Debug is not implemented. 


The TRCAUTHSTATUS can be accessed through the external debug interface, offset @xFB8. 
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C11.62 Device Architecture Register 


The TRCDEVARCH characteristics are: 


Purpose 


Identifies the ETM trace unit as an ETMv4 component. 


Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C71.1 ETM register summary on page C11-701. 


31 21 20.19 1615 


C11 ETM registers 
C11.62 Device Architecture Register 


0 


ARCHITECT i REVISION ARCHID 


PRESENT — 


Figure C11-60 TRCDEVARCH bit assignments 


ARCHITECT, [31:21] 
Defines the architect of the component: 


0x4 ARM JEP continuation. 
@x3B ARM JEP 106 code. 


PRESENT, [20] 
Indicates the presence of this register: 


@b1 Register is present. 


REVISION, [19:16] 
Architecture revision: 


@bee0ee Architecture revision 0. 


ARCHID, [15:0] 
Architecture ID: 


@x4A13 ETMv4 component. 


The TRCDEVARCH can be accessed through the external debug interface, offset @xFBC. 
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C11 ETM registers 
C11.63 Device ID Register 


C11.63 Device ID Register 
The TRCDEVID characteristics are: 


Purpose 
Indicates the capabilities of the ETM trace unit. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See C1l.] ETM register summary on page C11-701. 


31 0 


DEVID 


Figure C11-61 TRCDEVID bit assignments 


DEVID, [31:0] 
RAZ. There are no component-defined capabilities. 


The TRCDEVID can be accessed through the external debug interface, offset @xFC8. 
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C11 ETM registers 
C11.64 Device Type Register 


C11.64 Device Type Register 
The TRCDEVTYPE characteristics are: 


Purpose 
Indicates the type of the component. 
Usage constraints 
Accessible only from the external debug interface. 
Configurations 
Available in all configurations. 
Attributes 
C11.1 ETM register summary on page C11-701. 


31 8 7 4 3 0 


Figure C11-62 TRCDEVTYPE bit assignments 


[31:8] 
Reserved, RESO. 
SUB, [7:4] 
The sub-type of the component: 


@bee01 Processor trace. 


MAJOR, [3:0] 
The main type of the component: 


0b0011 Trace source. 


The TRCDEVTYPE can be accessed through the external debug interface, offset @xFCC. 
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C11.65 ETM Peripheral Identification Registers 


The ETM Peripheral Identification Registers provide standard information required for all CoreSight 


components. 


The following table lists the Peripheral ID Registers. 


C11 ETM registers 
C11.65 ETM Peripheral Identification Registers 


Table C11-3 Summary of the Peripheral ID Registers 





Register 


Value 


Offset 





Peripheral ID4 


8x04 


@xFD@ 





Peripheral ID5 


0x00 


@xFD4 





Peripheral ID6 


0x00 


OxFD8 





Peripheral ID7 


0x00 


@xFDC 





Peripheral IDO 


@xDA 


OxFE@ 





Peripheral ID1 


@xB9 


OxFE4 





Peripheral ID2 


@x2B 


OxFE8 








Peripheral ID3 


0x00 








OxFEC 








Only bits[7:0] of each Peripheral ID Register are used, with bits[31:8] reserved. Together, the eight 
Peripheral ID Registers define a single 64-bit Peripheral ID. 
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C11 ETM registers 
C11.66 ETM Peripheral Identification Register 0 


C11.66 ETM Peripheral Identification Register 0 


The TRCPIDRO characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the external debugger interface, offset @xFE@. 


Configurations 
Available in all implementations. 
Attributes 
TRCPIDRO is a 32-bit RO management register. 


See Cll.] ETM register summary on page C11-701. 
31 8 7 0 


Figure C11-63 TRCPIDRO bit assignments 


[31:8] 
Reserved, RESO. 
Part_0, [7:0] 


@xDA Least significant byte of the ETM trace unit part number. 
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C11 ETM registers 
C11.67 ETM Peripheral Identification Register 1 


C11.67 ETM Peripheral Identification Register 1 
The TRCPIDR1 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the external debug interface, offset @xFE4. 


Configurations 
Available in all implementations. 
Attributes 
TRCPIDR1 is a 32-bit RO management register. 


See C1l.] ETM register summary on page C11-701. 
31 8 7 4 3 0 


Figure C11-64 TRCPIDR1 bit assignments 


[31:8] 
Reserved, RESO. 
DES _0, [7:4] 


@xB ARM Limited. This is bits[3:0] of JEP106 ID code. 
Part_1, [3:0] 
0x9 Most significant four bits of the ETM trace unit part number. 
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C11.68 ETM Peripheral Identification Register 2 


C11.68 ETM Peripheral Identification Register 2 
The TRCPIDR2 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the external debug interface, offset @xFE8. 


Configurations 
Available in all implementations. 
Attributes 
TRCPIDR2 is a 32-bit RO management register. 


See C1l.] ETM register summary on page C11-701. 


31 8 7 432 0 
JEDEC — 


Figure C11-65 TRCPIDR2 bit assignments 


[31:8] 
Reserved, RESO. 
Revision, [7:4] 


0x2 r0p2. 
JEDEC, [3] 

@b1 RES1. Indicates a JEP 106 identity code is used. 
DES_1, [2:0] 

@b@11 ARM Limited. This is bits[6:4] of JEP 106 ID code. 
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C11.69 ETM Peripheral Identification Register 3 


C11.69 ETM Peripheral Identification Register 3 
The TRCPIDR3 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the external debug interface, offset @xFEC. 


Configurations 
Available in all implementations. 
Attributes 
TRCPIDR3 is a 32-bit RO management register. 


See C1l.] ETM register summary on page C11-701. 
31 8 7 4 3 0 


Figure C11-66 TRCPIDR3 bit assignments 


[31:8] 
Reserved, RESO. 
REVAND, [7:4] 





@xe Part minor revision. 
CMOD, [3:0] 
@xe Not customer modified. 
ARM 100236_0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights C11-782 


reserved. 
Non-Confidential 


C11 ETM registers 
C11.70 ETM Peripheral Identification Register 4 


C11.70 ETM Peripheral Identification Register 4 
The TRCPIDR4 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the external debug interface, offset @xFD@. 


Configurations 
Available in all implementations. 
Attributes 
TRCPIDR4 is a 32-bit RO management register. 


See C1l.] ETM register summary on page C11-701. 
31 8 7 4 3 0 


Figure C11-67 TRCPIDR4 bit assignments 


[31:8] 
Reserved, RESO. 
Size, [7:4] 
exe Size of the component. Log2 the number of 4KB pages from the start of the 
component to the end of the component ID registers. 
DES 2, [3:0] 
0x4 ARM Limited. This is bits[3:0] of the JEP106 continuation code. 
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C11 ETM registers 
C11.71 ETM Peripheral Identification Register 5-7 


C11.71 ETM Peripheral Identification Register 5-7 
No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. 


They are reserved for future use and are RESO. 
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C11.72 ETM Component Identification Registers 


C11.72 ETM Component Identification Registers 


There are four read-only ETM Component Identification Registers, Component IDO to Component ID3. 


Table C11-4 Summary of the ETM Component Identification Registers 





Register Value | Offset 





Component IDO | @x@D | @xFF@ 





Component ID1 | 0x90 | O@xFF4 





Component ID2 | 0x05 | OxFF8 

















Component ID3 | @xB1 | @xFFC 





The ETM Component Identification Registers identify ETM trace unit as a CoreSight component. 
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C11 ETM registers 
C11.73 ETM Component Identification Register 0 


C11.73 ETM Component Identification Register 0 
The TRCCIDRO characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the external debug interface, offset @xFF®. 


Configurations 
Available in all implementations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 


31 8 7 0 


Figure C11-68 TRCCIDRO bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 0, [7:0] 


@x@D Preamble byte 0. 
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C11 ETM registers 
C11.74 ETM Component Identification Register 1 


C11.74 ETM Component Identification Register 1 
The TRCCIDR1 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the external debug interface, offset @xFF4. 


Configurations 
Available in all implementations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 


31 8 7 4 3 0 


Figure C11-69 TRCCIDR1 bit assignments 


[31:8] 
Reserved, RESO 
CLASS, [7:4] 


0x9 Debug component. 
PRMBL 1, [3:0] 
@x® Preamble byte 1. 
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C11 ETM registers 
C11.75 ETM Component Identification Register 2 


C11.75 ETM Component Identification Register 2 
The TRCCIDR2 characteristics are: 


Purpose 
Provides information to identify a CTI component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the external debug interface, offset @xFF8. 


Configurations 
Available in all implementations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 


31 8 7 0 


Figure C11-70 TRCCIDR2 bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 2, [7:0] 


@x@5 Preamble byte 2. 
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C11 ETM registers 
C11.76 ETM Component Identification Register 3 


C11.76 ETM Component Identification Register 3 
The TRCCIDR3 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the external debug interface, offset @xFFC. 


Configurations 
Available in all implementations. 
Attributes 
See C11.1 ETM register summary on page C11-701. 


31 8 7 0 


Figure C11-71 TRCCIDR3 bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 3, [7:0] 


@xB1 Preamble byte 3. 
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Cll ETM registers 
C11.76 ETM Component Identification Register 3 
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Chapter C12 
CTI registers 


This chapter describes the CTI registers. 


It contains the following sections: 

e C12.1 Cross trigger register summary on page C12-792. 

e (C12.2 External register access permissions to the CTI registers on page C12-794. 
e (12.3 CTI Device Identification Register on page C12-795. 

e (12.4 CTI Integration Mode Control Register on page C12-796. 

e (12.5 CTI Peripheral Identification Registers on page C12-797. 

e (12.6 CTI Peripheral Identification Register 0 on page C12-798. 

e (12.7 CTI Peripheral Identification Register I on page C12-799. 

e (12.8 CTI Peripheral Identification Register 2 on page C12-800. 

e (12.9 CTI Peripheral Identification Register 3 on page C12-801. 

e C12.10 CTI Peripheral Identification Register 4 on page C12-802. 

e C12.11 CTI Peripheral Identification Register 5-7 on page C12-803. 
e C12.12 CTI Component Identification Registers on page C12-804. 

e C12.13 CTI Component Identification Register 0 on page C12-805. 
e (C12.14 CTI Component Identification Register 1 on page C12-806. 
e C12.15 CTI Component Identification Register 2 on page C12-807. 
e C12.16 CTI Component Identification Register 3 on page C12-808. 
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C12.1 


This section describes the cross trigger registers in the Cortex-A35 processor. These registers are 


Cross trigger register summary 


C12 CTI registers 
C12.1 Cross trigger register summary 


accessed through the external debug interface. 


The following table gives a summary of the Cortex-A35 cross trigger registers. For those registers not 


described in this chapter, see the ARM" Architecture Reference Manual ARMvé, for ARMv8-A 




















































































































architecture profile. 
Table C12-1 Cross trigger register summary 

Offset Name Type | Description 
0x000 CTICONTROL RW | CTI Control Register 
@x0@0-Ox@QC | - - Reserved 
0x010 CTIINTACK WO |CTI Output Trigger Acknowledge Register 
0x014 CTIAPPSET RW |CTI Application Trigger Set Register 
0x018 CTIAPPCLEAR WO |CTI Application Trigger Clear Register 
@x@1C CTIAPPPULSE WO _ | CTI Application Pulse Register 
0x020 CTIINENO RW | CTI Input Trigger to Output Channel Enable Registers 
0x024 CTINEN1 RW 
0x028 CTIINEN2 RW 
@x@2C CTIINEN3 RW 
0x030 CTIINEN4 RW 
0x034 CTIINEN5 RW 
0x038 CTIINEN6 RW 
@x@3C CTIINEN7 RW 
0x040-0X09C | - - Reserved 
Oxe0AO CTIOUTENO RW | CTI Input Channel to Output Trigger Enable Registers 
@x0A4 CTIOUTEN1 RW 
@x0@A8 CTIOUTEN2 RW 
@x@AC CTIOUTEN3 RW 
@x@Be CTIOUTEN4 RW 
@x@B4 CTIOUTENS RW 
@x@B8 CTIOUTEN6 RW 
@x@BC CTIOUTEN7 RW 
@x@CO-Ox12C | - - Reserved 
0x130 CTITRIGINSTATUS RO | CTI Trigger In Status Register 
0x134 CTITRIGOUTSTATUS | RO |CTI Trigger Out Status Register 
0x138 CTICHINSTATUS RO |CTI Channel In Status Register 
@x13C CTICHOUTSTATUS |RO | CTI Channel Out Status Register 
0x140 CTIGATE RW |CTI Channel Gate Enable Register 
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C12 CTI registers 
C12.1 Cross trigger register summary 


Table C12-1 Cross trigger register summary (continued) 


































































































Offset Name Type | Description 

0x144 ASICCTL RW | CTI External Multiplexer Control Register 

0x148 -0xF7C | - - Reserved 

OxFeO CTUTCTRL RW | C12.4 CTI Integration Mode Control Register on page C12-796 
@xFQ4-OxFA4 | - - Reserved 

OxFA@ CTICLAIMSET RW | CTI Claim Tag Set Register 

OxFA4 CTICLAIMCLR RW | CTI Claim Tag Clear Register 

OxFA8 CTIDEVAFFO RO | CTI Device Affinity Register 0 

@xFAC CTIDEVAFF1 RO | CTI Device Affinity Register 1 

OxFBO CTILAR WO _ |CTI Lock Access Register 

OxFB4 CTILSR RO |CTI Lock Status Register 

OxFB8 CTIAUTHSTATUS RO |CTI Authentication Status Register 

@xFBC CTIDEVARCH RO | CTI Device Architecture Register 

OxFCO CTIDEVID2 RO |CTI Device ID Register 2 

OxFC4 CTIDEVID1 RO |CTI Device ID Register 1 

OxFC8 CTIDEVID RO | C12.3 CTI Device Identification Register on page C12-795 

@xFCC CTIDEVTYPE RO | CTI Device Type Register 

@xFDO CTIPIDR4 RO | C12.10 CTI Peripheral Identification Register 4 on page C12-802 
@xFD4 CTIPIDRS RO | C12.11 CTI Peripheral Identification Register 5-7 on page C12-803 
@xFD8 CTIPIDR6 RO 

@xFDC CTIPIDR7 RO 

OxFEO CTIPIDRO RO | C12.6 CTI Peripheral Identification Register 0 on page C12-798 
OxFE4 CTIPIDRI RO | C12.7 CTI Peripheral Identification Register 1 on page C12-799 
OxFE8 CTIPIDR2 RO |C12.8 CTI Peripheral Identification Register 2 on page C12-800 
@xFEC CTIPIDR3 RO | C12.9 CTI Peripheral Identification Register 3 on page C12-801 
OxFFO CTICIDRO RO | C12.13 CTI Component Identification Register 0 on page C12-805 
OxFF4 CTICIDR1 RO | C12.14 CTI Component Identification Register 1 on page C12-806 
OxFF8 CTICIDR2 RO | C12.15 CTI Component Identification Register 2 on page C12-807 
OxFFC CTICIDR3 RO | C12.16 CTI Component Identification Register 3 on page C12-808 
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C12 CTI registers 
C12.2 External register access permissions to the CTI registers 


C12.2 External register access permissions to the CTI registers 


External access permission to the cross trigger registers is subject to the conditions at the time of the 
access. 


The following table describes the processor response to accesses through the external debug and 
memory-mapped interfaces. 


Table C12-2 External register conditions 





Name | Condition Description 





Off EDPRSR.PU is 0 Processor power domain is completely off, or in a low-power state where the 
processor power domain registers cannot be accessed. 





DLK | EDPRSR.DLK is 1 OS Double Lock is locked. 





OSLK | OSLSR_EL1.OSLK is 1 OS Lock is locked. 





EDAD | AllowExternalDebugAccess() ==FALSE | External debug access is disabled. When an error is returned because of an 
EDAD condition code, and this is the highest priority error condition, 
EDPRSR.SDAD is set to 1. Otherwise EDPRSR.SDAD is unchanged. 





SLK Memory-mapped interface only Software lock is locked. For the external debug interface, ignore this row. 





Default 














None of the conditions apply, normal access. 





The following table shows an example of external register condition codes for access to a cross trigger 
register. To determine the access permission for the register, scan the columns from left to right. Stop at 
the first column a condition is true, the entry gives the access permission of the register and scanning 





























stops. 
Table C12-3 External register condition code example 
Off | DLK | OSLK | EDAD | SLK | Default 
- - - - RO/WI | RO 
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C12 CTI registers 
C12.3 CTI Device Identification Register 


C12.3 CTI Device Identification Register 
The CTIDEVID characteristics are: 


Purpose 

Describes the CTI component to the debugger. 
Usage constraints 

The accessibility of CTIDEVID by condition code is: 





Off | DLK | OSLK | EDAD | SLK | Default 




















- - - - RO |RO 





C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 
CTIDEVID is in the Debug power domain. 
Attributes 
See the register summary in C/2./ Cross trigger register summary on page C12-792. 


26 25 24 23 22 21 16 15 14 13 87654 


INoUT — 
Figure C12-1 CTIDEVID bit assignments 


[31:26] 
Reserved, RESO. 

INOUT, [25:24] 
Input and output options. Indicates the presence of an input gate. The possible values are: 
@bee CTIGATE does not mask propagation of input events from external channels. 


@be1 CTIGATE masks propagation of input events from external channels. 


[23:22] 
Reserved, RESO. 
NUMCHAN, [21:16] 
Number of channels implemented. This value is: 


@bee1ee@ Four channels implemented. 
[15:14] 
Reserved, RESO. 


NUMTRIG, [13:8] 
Number of triggers implemented. This value is: 


@be10e0ee Fight triggers implemented. 
[7:5] 
Reserved, RESO. 


EXTMAXNUM, [4:0] 
Maximum number of external triggers implemented. This value is: 


@bee0eee No external triggers implemented. 


CTIDEVID can be accessed through the external debug interface, offset @xFC8. 
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C12.4 CTI Integration Mode Control Register 


C12.4 CTI Integration Mode Control Register 
The CTIITCTRL characteristics are: 


Purpose 


The CTUTCTRL shows that the Cortex-A35 processor does not implement an integration mode. 
Usage constraints 


The accessibility of CTUTCTRL by condition code is: 





Off | DLK | OSLK | EDAD | SLK | Default 




















- - - - RO/WI | RW 





C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 


CTIITCTRL is in the Debug power domain. 
Attributes 


See the register summary in C12. 1 Cross trigger register summary on page C12-792. 
31 


RESO i 


IME — 
Figure C12-2 CTIITCTRL bit assignments 
[31:1] 


Reserved, RESO. 
IME, [0] 


Integration mode enable. The possible value is: 


(3 Normal operation. 


CTIITCTRL can be accessed through the external debug interface, offset @xFee. 
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C12.5 CTI Peripheral Identification Registers 


C12.5 CTI Peripheral Identification Registers 


The CTI Peripheral Identification Registers provide standard information required for all components 
that conform to the ARM CoreSight architecture. 


The following table lists the CTI Peripheral Identification Registers. 


Table C12-4 Summary of the CTI Peripheral Identification Registers 





Register Value | Offset 





Peripheral ID4 | 0x04 | @xFD@ 





Peripheral ID5 | 0x00 | OxFD4 





Peripheral ID6 | 0x00 | OxFD8 





Peripheral ID7 | 0x00 | @xFDC 





Peripheral IDO | @xDA | OxFE@ 





Peripheral ID1 | @xB9 | @xFE4 





Peripheral ID2 | @x2B | OxFE8 





Peripheral ID3 | 0x00 | @xFEC 

















Only bits[7:0] of each Peripheral ID Register are used, with bits[31:8] reserved. Together, the eight 
Peripheral ID Registers define a single 64-bit Peripheral ID. 
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C12 CTI registers 
C12.6 CTI Peripheral Identification Register 0 


C12.6 CTI Peripheral Identification Register 0 
The CTIPIDRO characteristics are: 


Purpose 

Provides information to identify a CTI component. 
Usage constraints 

The accessibility of CTIPIDRO by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





a le ilies - RO [RO 























C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 
CTIPIDRO is in the Debug power domain. 


CTIPIDRO is optional to implement in the external register interface. 


Attributes 
See the register summary in C12. 1 Cross trigger register summary on page C12-792. 


31 8 7 0 


Figure C12-3 CTIPIDRO bit assignments 


[31:8] 
Reserved, RESO. 
Part_0, [7:0] 


@xDA Least significant byte of the cross trigger part number. 


CTIPIDRO can be accessed through the external debug interface, offset @xFE@. 
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C12.7 CTI Peripheral Identification Register 1 


CTI Peripheral Identification Register 1 


The CTIPIDR1 characteristics are: 


Purpose 

Provides information to identify a CTI component. 
Usage constraints 

The accessibility of CTIPIDR1 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 























a le ilies - RO [RO 





C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 
CTIPIDR1 is in the Debug power domain. 


CTIPIDR1 is optional to implement in the external register interface. 


Attributes 
See the register summary in C/2./ Cross trigger register summary on page C12-792. 


31 8 7 4 3 0 


Figure C12-4 CTIPIDR1 bit assignments 


[31:8] 
Reserved, RESO. 
DES_0, [7:4] 


@xB ARM Limited. This is the least significant nibble of JEP106 ID code. 


Part_1, [3:0] 
0x9 Most significant nibble of the CTI part number. 


CTIPIDRI can be accessed through the external debug interface, offset @xFE4. 
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C12 CTI registers 
C12.8 CTI Peripheral Identification Register 2 


C12.8 CTI Peripheral Identification Register 2 
The CTIPIDR2 characteristics are: 


Purpose 

Provides information to identify a CTI component. 
Usage constraints 

The accessibility of CTIPIDR2 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





- RO |RO 























C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 
CTIPIDR2 is in the Debug power domain. 


CTIPIDR2 is optional to implement in the external register interface. 


Attributes 
See the register summary in C/2./ Cross trigger register summary on page C12-792. 
31 8 7 4 3 2 0 
JEDEC — 


Figure C12-5 CTIPIDR2 bit assignments 


[31:8] 
Reserved, RESO. 
Revision, [7:4] 


@x2 r0p2. 


JEDEC, [3] 
@b1 RES1. Indicates a JEP 106 identity code is used. 


DES_1, [2:0] 
@be11 ARM Limited. This is the most significant nibble of JEP 106 ID code. 


CTIPIDR2 can be accessed through the external debug interface, offset @xFE8. 
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C12.9 CTI Peripheral Identification Register 3 


CTI Peripheral Identification Register 3 


The CTIPIDR3 characteristics are: 


Purpose 

Provides information to identify a CTI component. 
Usage constraints 

The accessibility of CTIPIDR3 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





- - - - RO |RO 























C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 
CTIPIDR3 is in the Debug power domain. 


CTIPIDR3 is optional to implement in the external register interface. 


Attributes 
See the register summary in C/2./ Cross trigger register summary on page C12-792. 


31 8 7 4 3 0 


Figure C12-6 CTIPIDR3 bit assignments 


[31:8] 
Reserved, RESO. 
REVAND, [7:4] 


@xe Part minor revision. 
CMOD, [3:0] 
@xe Customer modified. 


CTIPIDR3 can be accessed through the external debug interface, offset @xFEC. 
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C12 CTI registers 
C12.10 CTI Peripheral Identification Register 4 


C12.10 CTI Peripheral Identification Register 4 


The CTIPIDR4 characteristics are: 


Purpose 

Provides information to identify a CTI component. 
Usage constraints 

The accessibility of CTIPIDR4 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





- RO |RO 























C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 
CTIPIDR4 is in the Debug power domain. 


CTIPIDR4 is optional to implement in the external register interface. 


Attributes 
See the register summary in C/2./ Cross trigger register summary on page C12-792. 


31 8 7 4 3 0 


Figure C12-7 CTIPIDR4 bit assignments 


[31:8] 
Reserved, RESO. 
Size, [7:4] 


exe Size of the component. Log2 the number of 4KB pages from the start of the 
component to the end of the component ID registers. 


DES _2, [3:0] 
0x4 ARM Limited. This is the least significant nibble JEP106 continuation code. 


CTIPIDR4 can be accessed through the external debug interface, offset 0xFDO. 
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C12 CTI registers 
C12.11 CTI Peripheral Identification Register 5-7 


C12.11 CTI Peripheral Identification Register 5-7 
No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. 


They are reserved for future use and are RESO. 
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C12 CTI registers 
C12.12 CTI Component Identification Registers 


C12.12 CTI Component Identification Registers 


There are four read-only CTI Component Identification Registers, Component IDO through Component 
ID3. 


Table C12-5 Summary of the CTI Component Identification Registers 





Register Value | Offset 





Component IDO | @x@D | @xFF@ 





Component ID1 | 0x90 | O@xFF4 





Component ID2 | 0x05 | OxFF8 





Component ID3 | @xB1 | @xFFC 




















ARM 100236 _0002_00_en Copyright © 2015-2017 ARM Limited or its affiliates. All rights C12-804 
reserved. 
Non-Confidential 


C12 CTI registers 
C12.13 CTI Component Identification Register 0 


C12.13 CTI Component Identification Register 0 
The CTICIDRO characteristics are: 


Purpose 

Provides information to identify a CTI component. 
Usage constraints 

The accessibility of CTICIDRO by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 























a te ilies - RO [RO 





C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 
CTICIDRO is in the Debug power domain. 


CTICIDRO is optional to implement in the external register interface. 


Attributes 
See the register summary in C12. 1 Cross trigger register summary on page C12-792. 


31 8 7 0 


Figure C12-8 CTICIDRO bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 0, [7:0] 


@x@D Preamble byte 0. 


CTICIDRO can be accessed through the external debug interface, offset @xFF@. 
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C12 CTI registers 
C12.14 CTI Component Identification Register 1 


C12.14 CTI Component Identification Register 1 


The CTICIDR1 characteristics are: 


Purpose 

Provides information to identify a CTI component. 
Usage constraints 

The accessibility of CTICIDR1 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 























a te ilies - RO [RO 





C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 
CTICIDRI is in the Debug power domain. 


CTICIDRI1 is optional to implement in the external register interface. 


Attributes 
See the register summary in C/2./ Cross trigger register summary on page C12-792. 
31 8 7 4 3 0 
Figure C12-9 CTICIDR1 bit assignments 
[31:8] 


Reserved, RESO. 
CLASS, [7:4] 


@x9 Debug component. 


PRMBL 1, [3:0] 
@xe Preamble byte 1. 


CTICIDRI can be accessed through the external debug interface, offset @xFF4. 
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C12 CTI registers 
C12.15 CTI Component Identification Register 2 


C12.15 CTI Component Identification Register 2 
The CTICIDR2 characteristics are: 


Purpose 

Provides information to identify a CTI component. 
Usage constraints 

The accessibility of CTICIDR2 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





a te ilies - RO [RO 























C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 
CTICIDR2 is in the Debug power domain. 


CTICIDR2 is optional to implement in the external register interface. 


Attributes 
See the register summary in C/2./ Cross trigger register summary on page C12-792. 


31 8 7 0 


Figure C12-10 CTICIDR2 bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 2, [7:0] 


@x@5 Preamble byte 2. 


CTICIDR2 can be accessed through the external debug interface, offset @xFF8. 
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C12 CTI registers 
C12.16 CTI Component Identification Register 3 


C12.16 CTI Component Identification Register 3 
The CTICIDR3 characteristics are: 


Purpose 

Provides information to identify a CTI component. 
Usage constraints 

The accessibility of CTICIDR3 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





a te ilies - RO [RO 























C12.2 External register access permissions to the CTI registers on page C12-794 describes the 
condition codes. 


Configurations 
CTICIDR3 is in the Debug power domain. 


CTICIDR3 is optional to implement in the external register interface. 


Attributes 
See the register summary in C12. 1 Cross trigger register summary on page C12-792. 


31 8 7 0 


Figure C12-11 CTICIDR3 bit assignments 


[31:8] 
Reserved, RESO. 
PRMBL 3, [7:0] 


@xB1 Preamble byte 3. 


CTICIDR3 can be accessed through the external debug interface, offset @xFFC. 
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Part D 
Appendices 


Appendix A 
Signal Descriptions 


This appendix describes the signals at the external interfaces of the processor. 


It contains the following sections: 

¢ A.l About the signal descriptions on page Appx-A-812. 
e A.2 Processor configuration signals on page Appx-A-813. 
e A.3 Clock signals on page Appx-A-8 14. 

e A.4 Reset signals on page Appx-A-815. 

e A.5 GIC signals on page Appx-A-816. 

e A.6 Generic Timer signals on page Appx-A-819. 

e A.7 Power management signals on page Appx-A-820. 

e A.8 L2 error signals on page Appx-A-822. 

e A.9 ACP interface signals on page Appx-A-823. 

¢ A.10 Broadcast signals for the memory interface on page Appx-A-825. 
e A.l] AXI interface signals on page Appx-A-826. 

e A.12 ACE interface signals on page Appx-A-828. 

e A.13 CHI interface signals on page Appx-A-832. 

e A.14 Debug signals on page Appx-A-835. 

e A.15 APB interface signals on page Appx-A-837. 

¢ A.16 ATB interface signals on page Appx-A-838. 

e A.17 ETM signals on page Appx-A-839. 

e A.18 PMU interface signals on page Appx-A-840. 

e A.19 CTI interface signals on page Appx-A-841. 

e A.20 DFT interface signals on page Appx-A-842. 

e A.21 MBIST interface signals on page Appx-A-843. 
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A Signal Descriptions 
A.1 About the signal descriptions 


A.1 About the signal descriptions 


The tables in this appendix provide direction information and high-level descriptions about the signals at 
the external interfaces of the processor. 


Some of the buses include a configurable width field, <Signal>[CN:0], where CN = 0, 1, 2, or 3, to 
encode up to four cores. For example: 


e nIRQJ[0] represents a core 0 interrupt request. 
e nIRQJ[2] represents a core 2 interrupt request. 


Some signals are specified in the form <signal>x where x = 0, 1, 2 or 3 to reference core 0, core 1, core 
2, core 3. If a core is not present, the corresponding pin is removed. For example: 

e PMUEVENT0[29:0] represents the core 0 PMU event bus. 

e PMUEVENT3[29:0] represents the core 3 PMU event bus. 


The number of signals changes depending on the configuration. For example, the CHI interface signals 
are not present when the processor is configured to have an ACE memory interface. 
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A Signal Descriptions 
A.2 Processor configuration signals 


A.2 Processor configuration signals 


The processor samples configuration signals only during cluster reset. 


Table A-1 Processor configuration signals 






































Signal Direction | Description 
AA64nAA32[CN:0] Input Register width state: 
7) AArch32. 
1 AArché4. 
CFGEND[CN:0] Input Endianness configuration at reset. It sets the initial value of SCTLR_EL3.EE and 
SCTR_S.EE: 
(3 LOW. 
1 HIGH. 
CFGTE[CN:0] Input Enabling T32 exceptions. It sets the initial value of SCTLR.TE: 
[3] LOW. 
1 HIGH. 
CLUSTERIDAFF1[7:0] Input Value read in MPIDR.Aff1. 
This signal is sampled only during processor reset. 
CLUSTERIDAFF?2[7:0] Input Value read in MPIDR.Aff2. 
This signal is sampled only during processor reset. 
CRYPTODISABLE[CN:0] | Input Disabling the Cryptographic Extensions. 
RVBARADDR«x([39:2] Input Reset Vector Base Address for executing in 64-bit state. 
VINITHI[CN:0] Input Location of the exception vectors at reset. It sets the initial value of SCTLR.V: 


(2 Exception vectors start at address 0OX000000OOA. 
1 Exception vectors start at address @xF FFFQQ@O. 








Related information 

B1.97 Multiprocessor Affinity Register on page B1-303. 
B1.105 System Control Register on page B1-319. 

B2.90 System Control Register, ELI on page B2-506. 
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Appx-A-813 


A.3 Clock signals 


The processor uses a single standard clock signal. 


A Signal Descriptions 
A.3 Clock signals 


Table A-2 Clock signal 





Signal 


Direction | Description 








CLKIN 





Input Global clock 











Related information 
A3.1 Clocks on page A3-48. 
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A.4 Reset signals 


A Signal Descriptions 
A.4 Reset signals 


The processor uses a set of reset signals. 


Table A-3 Reset and reset control signals 





Signal 


Direction 


Description 





nCPUPORESET[CN:0] 


Input 


Processor powerup reset: 
) Apply reset to all processor logic. 


1 Do not apply reset to all processor logic. 


Processor logic includes Advanced SIMD and floating-point, debug, ETM trace unit, 
breakpoint and watchpoint logic. 
































nCORERESET[CN:0] | Input Individual core resets excluding debug and ETM trace unit: 

(2) Apply reset to processor logic. 

1 Do not apply reset to processor logic. 
nPRESETDBG Input See 4.15 APB interface signals on page Appx-A-837. 
nL2RESET Input L2 memory system reset: 

(2) Apply reset to the shared L2 memory system controller. 

1 Do not apply reset to the shared L2 memory system controller. 
nMBISTRESET Input See 4.21 MBIST interface signals on page Appx-A-843. 
L2RSTDISABLE Input Disable the automatic invalidation of the L2 cache at reset: 

(2 Hardware resets the L2 cache. 

1 Hardware does not reset the L2 cache. 

This signal is sampled only during processor reset. 
WARMRSTREQ[CN:0] | Output Request for a processor warm reset: 

(2) Do not apply warm reset. 

1 Apply warm reset. 

DBGRSTREQ[CN:0] Output Warm reset request. 
DBGLIRSTDISABLE |Input Disable the automatic invalidation of the L1 data cache at processor reset: 





(2) Enable automatic invalidation of L1 data cache on reset. 


1 Disable automatic invalidation of L1 data cache on reset. 


This signal is sampled only during processor reset. 








Related information 
A3.3 Resets on page A3-50. 
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A.5 GIC signals 


The processor uses a range of signals for global disable, base address definition, interrupt types, and 
Distributor messaging. 


A Signal Descriptions 
A.5 GIC signals 


This interface exists only if the processor is configured to use the GIC CPU interface. However, the first 
seven signals in the following table are present even when the processor is configured without a GIC 


CPU interface. 


Table A-4 GIC signals 





Signal 


Direction 


Description 





nFIQ[CN:0] 


Input 


FIQ request. Active-LOW, level sensitive, asynchronous FIQ interrupt request: 


(2) Activate FIQ interrupt. 
1 Do not activate FIQ interrupt. 


The processor treats the nFIQ input as level-sensitive. The nFIQ input must be asserted until 
the processor acknowledges the interrupt. 





nIRQ[CN:0] 


Input 


IRQ request input lines. Active-LOW, level sensitive, asynchronous interrupt request: 
e Activate interrupt. 


1 Do not activate interrupt. 


The processor treats the nIRQ input as level-sensitive. The nIRQ input must be asserted until 
the processor acknowledges the interrupt. 





nSEI[CN:0] 


Input 


System Error Interrupt request. Active-LOW, edge sensitive: 


e Activate SEI request. 


1 Do not activate SEI request. 


The processor treats nSEI as edge-sensitive. The nSEI signal must be sent as a pulse to the 
processor. 


Asserting the nSEI input causes one of the following to occur: 

e Asynchronous Data Abort, if taken to AArch32. The DFSR.FS field is set to indicate an 
Asynchronous External Abort. 

¢ SError interrupt, if taken to AArch64. The ESR_ELx.ISS field is set. 





nVFIQ[CN:0] 


Input 


Virtual FIQ request. Active-LOW, level sensitive, asynchronous FIQ interrupt request: 


(2) Activate FIQ interrupt. 
1 Do not activate FIQ interrupt. 


The processor treats the nVFIQ input as level-sensitive. The nVFIQ input must be asserted 
until the processor acknowledges the interrupt. If the GIC is enabled by tying 
GICCDISABLE LOW, nVFIQ must be tied off to HIGH. If the GIC is disabled by tying 
GICCDISABLE HIGH, nVFIQ can be driven by an external GIC in the SoC. 





nVIRQ[CN:0] 





Input 








Virtual IRQ request. Active-LOW, level sensitive, asynchronous interrupt request: 


(2) Activate interrupt. 


1 Do not activate interrupt. 


The processor treats nVIRQ as level-sensitive. nVIRQ must be asserted until the processor 
acknowledges the interrupt. If the GIC is enabled by tying GICCDISABLE LOW, nVIRQ 
must be tied off to HIGH. If the GIC is disabled by tying GICCDISABLE HIGH, nVIRQ 

can be driven by an external GIC in the SoC. 
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A Signal Descriptions 
A.5 GIC signals 


Table A-4 GIC signals (continued) 











Signal Direction | Description 

nVSEI[CN:0] Input Virtual System Error Interrupt request. Active-LOW, edge sensitive: 
(2] Activate virtual SEI request. 
1 Do not activate virtual SEI request. 


The processor treats nVSEI as edge-sensitive. The nVSEI signal must be sent as a pulse to 
the processor. 


Asserting nVSEI causes one of the following to occur: 

e Asynchronous Data Abort, if taken to AArch32. The DFSR.FS field is set to indicate an 
Asynchronous External Abort. 

¢ SError interrupt, if taken to AArch64. The ESR_EL1.ISS field is set. 





nREI[CN:0] Input RAM Error Interrupt request. Active-LOW, edge sensitive: 
p 
e Activate REI request. Reports an asynchronous RAM error in the system. 
1 Do not activate REI request. 


The processor treats nREI as edge-sensitive. The nREI signal must be sent as a pulse to the 
processor. 


Asserting the nREI input causes one of the following to occur: 

e Asynchronous Data Abort, if taken to AArch32. The DFSR.FS field is set to indicate an 
Asynchronous parity error on memory access. 

¢ SError interrupt, if taken to AArch64. The ESR_ELx.ISS field is set. 





nVCPUMNTIRQ[CN:0] | Output Virtual CPU interface maintenance interrupt PPI output. 








PERIPHBASE[39: 18] Input Specifies the base address for the GIC registers. This value is sampled into CBAR at reset. 
GICCDISABLE Input Globally disables the GIC CPU interface logic and routes the external signals directly to the 
processor: 
(2) Enable the GIC CPU interface logic. 
1 Disable the GIC CPU interface logic and route the legacy nIRQ, nFIQ, nVIRQ, 


and nVFIQ signals directly to the processor. Drive this signal HIGH when you are 
using a legacy interrupt controller such as the GIC-400 which does not support 
GICv3 or GICv4. 














Table A-5 AXI4 Stream Protocol signals for messages from the Distributor to the GIC CPU Interface 



































Signal Direction | Description 
ICDTVALID Input Indicates that the master is driving a valid transfer. 
ICDTREADY Output Indicates that the slave can accept a transfer in the current cycle. 
ICDTDATA[15:0] | Input Primary payload for the data that is passing across the interface. 
ICDTLAST Input Indicates the boundary of a packet. 
ICDTDEST{[1:0] | Input Routing information for the data stream. 
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A Signal Descriptions 
A.5 GIC signals 


Table A-6 AXI4 Stream Protocol signals for messages from the GIC CPU Interface to the Distributor 











Signal Direction | Description 
ICCTVALID Output Indicates that the master is driving a valid transfer. 
ICCTREADY Input Indicates that the slave can accept a transfer in the current cycle. 





ICCTDATA[15:0] | Output Primary payload for the data that is passing across the interface. 





ICCTLAST Output Indicates the boundary of a packet. 








ICCTID[1:0] Output Data stream identifier. 











Related information 

B1.49 Data Fault Status Register on page B1-213. 

B2.41 Exception Syndrome Register, ELI on page B2-411. 
B1.38 Configuration Base Address Register on page B1-191. 
Chapter A12 GIC CPU Interface on page A12-137. 
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A.6 Generic Timer signals 


A Signal Descriptions 
A.6 Generic Timer signals 


The processor uses a standard set of signals for the Generic Timer. 


Table A-7 Generic Timer signals 





























Signal Direction | Description 
nCNTHPIRQ[CN:0] | Output Hypervisor physical timer event. 
nCNTPNSIRQ[CN:0] | Output Non-secure physical timer event. 
nCNTPSIRQ[CN:0] | Output Secure physical timer event. 
nCNTVIRQ[CN:0] Output Virtual physical timer event. 
CNTCLKEN Input Counter clock enable. 
This clock enable must be asserted one cycle before the CNTVALUEB bus. 
CNTVALUEB[63:0] | Input Global system counter value in binary format. 











Related information 


A2.4 About the Generic Timer on page A2-4S. 
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A Signal Descriptions 
A.7 Power management signals 












































A.7 Power management signals 
The processor has retention and non-retention signals for power management. 
Table A-8 Non-Retention power management signals 
Signal Direction | Description 
CLREXMONREQ Input Clearing of the external global exclusive monitor request. When this signal is asserted, it 
acts as a WFE wake-up event to all the cores in the processor device. 
CLREXMONACK Output Clearing of the external global exclusive monitor acknowledge. 
EVENTI Input Event input for processor wake-up from WFE state. 
EVENTO Output Event output. Active when a SEV instruction is executed. 
STANDBYWFI[CN:0] Output Indicates whether a core is in WFI low-power state: 
(2) Core not in WFI low-power state. 
1 Core in WFI low-power state. This is the reset condition. 
STANDBYWFE[CN:0] Output Indicates whether a core is in WFE low-power state: 
e Core not in WFE low-power state. 
1 Core in WFE low-power state. 
STANDBYWFIL2 Output Indicates whether the L2 memory system is in WFI low-power state. This signal is active 
when the following conditions are met: 
e All cores are in WFI low-power state, held in reset, or nLZRESET is asserted LOW. 
°. Inan ACE configuration, ACINACTM is asserted HIGH. 
e Ina CHI configuration, SINACT is asserted HIGH. 
¢ If ACP has been configured, AINACTS is asserted HIGH. 
e L2 memory system is idle. 
L2FLUSHREQ Input L2 hardware flush request. 
L2FLUSHDONE Output L2 hardware flush complete. 
SMPEN[CN:0] Output Indicates whether a core is taking part in coherency. 
DBGNOPWRDWN[CN:90] | Output Request not to power down the core: 
(3) Do not request that the core stays powered-up. 
1 Request that the core stays powered-up. 
DBGPWRUPREQ[CN:0] | Output Core power-up request: 
e Do not request that the core is powered up. 
1 Request that the core is powered up. 
DBGPWRDUP[CN:0] Input Core powered up 











e Core is powered down. 


1 Core is powered up. 
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A Signal Descriptions 
A.7 Power management signals 


Table A-9 Retention power management signals 





Signal 


Direction 


Description 





CPUQACTIVE|CN:0] 


Output 


Indicates whether the referenced core is active 









































CPUQREQn[CN:0] Input Indicates that the power controller is ready to enter or exit retention for the referenced core 

CPUQDENY[CN:0] Output Indicates that the referenced core denies the power controller retention request 

CPUQACCEPTn[CN:0] | Output Indicates that the referenced core accepts the power controller retention request 

NEONQACTIVE[CN:0] | Output Indicates whether the referenced Advanced SIMD and Floating-point block is active 

NEONQREQn[CN:0] Input Indicates that the power controller is ready to enter or exit retention for the referenced 
Advanced SIMD and Floating-point block 

NEONQDENY[CN:0] Output Indicates that the referenced Advanced SIMD and Floating-point block denies the power 
controller retention request 

NEONQACCEPThn[CN:0] | Output Indicates that the referenced Advanced SIMD and Floating-point block accepts the power 
controller retention request 

L2QACTIVE Output Indicates whether the L2 data RAMs are active 

L2QREQn Input Indicates that the power controller is ready to enter or exit retention for the L2 data RAMs 

L2QDENY Output Indicates that the L2 data RAMs deny the power controller retention request 

L2QACCEPTn Output Indicates that the L2 data RAMs accept the power controller retention request 














Related information 
Chapter A4 Power Management on page A4-53. 
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A.8 L2 error signals 


A Signal Descriptions 
A.8 L2 error signals 


The processor has signals for errors in the Level 2 cache. 


Table A-10 L2 error signals 











Signal Direction | Description 
nEXTERRIRQ | Output Error indicator for memory transactions with a write response error condition. 
nINTERRIRQ | Output Error indicator for L2 RAM double-bit ECC error. 














Related information 
A7.5 Handling of external aborts on page A7-99. 
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A Signal Descriptions 
A.9 ACP interface signals 


A.9 ACP interface signals 


The AXI protocol supports clock, configuration, and data handling signals if the processor implements 
the ACP slave interface to an external master to make coherent request to the shared L2 cache of the 
cluster. 


This interface exists only if the processor is configured to have the ACP interface. 


All ACP channels must be balanced with respect to CLKIN and timed relative to ACLKENS. 


Table A-11 ACP clock and Configuration signals 











Signal Direction | Description 
ACLKENS | Input AXI slave bus clock enable. 
AINACTS | Input ACP master is inactive and is not participating in coherency. There must be no outstanding transactions 


when the master asserts this signal, and while it is asserted the master must not send any new transactions: 


(2) ACP Master is active. 
1 ACP Master is inactive. 


This signal must be asserted before the processor enters the low-power L2 WFI state. 

















Table A-12 ACP write address channel signals 
















































































Signal Direction | Description 

AWREADYS Output Write address ready 

AWVALIDS Input Write address valid 

AWIDS [4:0] Input Write address ID 

AWADDRS[39:0] | Input Write address 

AWLENS[7:0] Input Write burst length 

AWCACHES{3:0] | Input Write cache type 

AWUSERS [1:0] Input Write attributes: 

[0] Inner Shareable. 
[1] Outer Shareable. 
AWPROTS[2:0] | Input Write protection type 
Table A-13 ACP write data channel signals 

Signal Direction | Description 
WREADYS Output Write data ready 
WVALIDS Input Write data valid 
WDATAS[127:0] | Input Write data 
WSTRBS[15:0] | Input Write byte-lane strobes 
WLASTS Input Write data last transfer indication 
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A Signal Descriptions 
A.9 ACP interface signals 


Table A-14 ACP write response channel signals 


Table A-15 ACP read address channel signals 




















Signal Direction | Description 
BREADYS _ | Input Write response ready 
BVALIDS Output Write response valid 
BIDS[4:0] Output Write response ID 
BRESPS[1:0] | Output Write response 






































Signal Direction | Description 
ARREADYS Output Read address ready 
ARVALIDS Input Read address valid 
ARIDS[4:0] Input Read address ID 
ARADDRS{[39:0] | Input Read address 
ARLENS[7:0] Input Read burst length 
ARCACHES [3:0] | Input Read cache type 
ARUSERS [1:0] Input Read attributes: 

[0] Inner Shareable. 

[1] Outer Shareable. 
ARPROTS[2:0] | Input Read protection type 














Table A-16 ACP read data channel signals 





























Signal Direction | Description 

RREADYS Input Read data ready 

RVALIDS Output Read data valid 

RIDS[4:0] Output Read data ID 

RDATAS[127:0] | Output Read data 

RRESPS[1:0] Output Read response 

RLASTS Output Read data last transfer indication 
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A Signal Descriptions 
A.10 Broadcast signals for the memory interface 
































A.10 Broadcast signals for the memory interface 
The processor has broadcast signals for the memory interface. These signals are only sampled at 
processor reset. 
The signals in the following table only exist if the processor is configured to have an ACE or CHI 
memory interface. 
Table A-17 Broadcast signals 
Signal Direction | Description 
BROADCASTCACHEMAINT | Input Enable broadcasting of cache maintenance operations to downstream caches: 
@ Cache maintenance operations are not broadcast to downstream caches. 
1 Cache maintenance operations are broadcast to downstream caches. 
BROADCASTINNER Input Enable broadcasting of Inner Shareable transactions: 
© Inner Shareable transactions are not broadcast externally. 
1 Inner Shareable transactions are broadcast externally. 
If BROADCASTINNER is tied HIGH, you must also tie BROADCASTOUTER 
HIGH. 
BROADCASTOUTER Input Enable broadcasting of outer shareable transactions: 
@ Outer Shareable transactions are not broadcast externally. 
1 Outer Shareable transactions are broadcast externally. 
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AXI interface signals 


A Signal Descriptions 
A.11 AXI interface signals 


The AXI protocol supports clock, configuration, and data handling signals when the processor uses this 
protocol for the master memory interface. 


This interface exists only if the processor is configured to have the AXI interface. 


All AXI channels must be balanced with respect to CLKIN and timed relative to ACLKENM. 


Table A-18 AXI clock and configuration signals 























Signal Direction | Description 

ACLKENM Input AXI Master bus clock enable. See 43.7 Clocks on page A3-48 for more information. 
RDMEMATTR[7:0] | Output Read request memory attributes. 

WRMEMATTR[7:0] | Output Write request memory attributes. 








Table A-19 AXI write address channel signals 






































Signal Direction | Description 
AWADDRM[39:0] | Output Write address. 
AWBURSTM[1:0] | Output Write burst type. 
AWCACHEM[3:0] | Output Write cache type. 
AWIDM[4:0] Output Write address ID. 
AWLENM|([7:0] Output Write burst length. 
AWLOCKM Output Write lock type. 
AWPROTM[2:0] | Output Write protection type. 
AWREADYM Input Write address ready. 
AWSIZEM|2:0] Output Write burst size. 
AWVALIDM Output Write address valid. 














Table A-20 AXI write data channel signals 


























Signal Direction | Description 

WDATAM[127:0] | Output Write data 

WIDM|[4:0] Output Write data ID 

WLASTM Output Write data last transfer indication 
WREADYM Input Write data ready 
WSTRBM{[15:0] | Output Write byte-lane strobes 
WVALIDM Output Write data valid 














Table A-21 AXI write data response channel signals 














Signal Direction | Description 
BIDM/[4:0] Input Write response ID 
BREADYM _ | Output Write response ready 
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A Signal Descriptions 
A.11 AXI interface signals 


Table A-21 AXI write data response channel signals (continued) 














Signal Direction | Description 
BRESPM{[1:0] | Input Write response 
BVALIDM Input Write response valid 











Table A-22 AXI read address channel signals 





Signal 


Direction | Description 





ARADDRM{[39:0] 


Output Read address. 





ARBURSTM[1:0] 


Output Read burst type. 





ARCACHEM{3:0] 


Output Read cache type 





ARIDM[5:0] 


Output Read address ID 





ARLENM[7:0] 


Output Read burst length 





ARLOCKM 


Output Read lock type 





ARPROTM[2:0] 


Output Read protection type 





ARREADYM 


Input Read address ready 





ARSIZEM[2:0] 


Output Read burst size 








ARVALIDM 





Output Read address valid 











Table A-23 AXI read data channel signals 





























Signal Direction | Description 

RDATAM[127:0] | Input Read data 

RIDMJ5:0] Input Read data ID 

RLASTM Input Read data last transfer indication 
RREADYM Output Read data ready 

RRESPM[1:0] Input Read data response 

RVALIDM Input Read data valid 











Related information 
ARM® AMBA® AXI and ACE Protocol Specification AX13, AXI4, and AX1I4-Lite, and ACE and ACE- 


Lite. 
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A.12 ACE interface signals 













































































A.12 ACE interface signals 
The ACE protocol supports clock, configuration, and data handling signals when the processor uses this 
protocol for the master memory interface. 
This interface exists only if the Cortex-A35 processor is configured to have the ACE interface. 
All ACE channels must be balanced with respect to CLKIN and timed relative to ACLKENM. 
Table A-24 ACE clock and configuration signals 
Signal Direction | Description 
ACLKENM Input ACE Master bus clock enable. 
ACINACTM Input Snoop interface is inactive and not participating in coherency: 
e Snoop interface is active. 
1 Snoop interface is inactive. 
RDMEMATTRJ7:0] | Output Read request memory attributes. 
WRMEMATTR[7:0] | Output Write request memory attributes. 
Table A-25 ACE write address channel signals 
Signal Direction | Description 
AWADDRM [43:0] Output Write address. 
AWBARM([1:0] Output Write barrier type. 
AWBURSTM{[1:0] Output Write burst type. 
AWCACHEM|3:0] | Output Write cache type. 
AWDOMAINM [1:0] | Output Write shareability domain type. 
AWIDM[4:0] Output Write address ID. 
AWLENM]7:0] Output Write burst length. 
AWLOCKM Output Write lock type. 
AWPROTM2:0] Output Write protection type. 
AWREADYM Input Write address ready. 
AWSIZEM[2:0] Output Write burst size. 
AWSNOOPM [2:0] | Output Write snoop request type. 
AWUNIQUEM Output For WriteBack, WriteClean and WriteEvict transactions. 
Indicates that the write is: 
7) Shared. 
1 Unique. 
AWVALIDM Output Write address valid. 
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A Signal Descriptions 
A.12 ACE interface signals 


Table A-26 ACE write data channel signals 





Signal Direction | Description 





WDATAM[127:0] | Output Write data 











WIDM[4:0] Output Write data ID 
WLASTM Output Write data last transfer indication 
WREADYM Input Write data ready 








WSTRBM[15:0] | Output Write byte-lane strobes 





WVALIDM Output Write data valid 














Table A-27 ACE write data response channel signals 





Signal Direction | Description 





BIDM/[4:0] Input Write response ID 





BREADYM _ | Output Write response ready 





BRESPM{[1:0] | Input Write response 





BVALIDM Input Write response valid 














Table A-28 ACE read address channel signals 





Signal Direction | Description 





ARADDRM[43:0] | Output Read address. 
The top 4 bits communicate only the ACE virtual address for DVM messages. 


The top 4 bits are Read-as-Zero if a DVM message is not being broadcast. 





ARBARM[1:0] Output Read barrier type. 





ARBURSTM[1:0] | Output Read burst type. 





ARCACHEMJ3:0] | Output Read cache type. 





ARDOMAINM[1:0] | Output Read shareability domain type. 











ARIDM/J5:0] Output Read address ID. 
ARLENM[7:0] Output Read burst length. 
ARLOCKM Output Read lock type. 





ARPROTM[2:0] Output Read protection type. 





ARREADYM Input Read address ready. 





ARSIZEM[2:0] Output Read burst size. 





ARSNOOPMJ[3:0] | Output Read snoop request type. 























ARVALIDM Output Read address valid. 
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Table A-29 ACE read data channel signals 


























Signal Direction | Description 

RDATAM[127:0] | Input Read data 

RIDMJ5:0] Input Read data ID 

RLASTM Input Read data last transfer indication 
RREADYM Output Read data ready 

RRESPM[3:0] Input Read data response 

RVALIDM Input Read data valid 














Table A-30 ACE coherency address channel signals 





Signal Direction | Description 





ACADDRM[43:0] | Input Snoop address. 


The top 4 bits communicate only the ACE virtual address for DVM messages. 





ACPROTM[2:0] | Input Snoop protection type. 





ACREADYM Output Master ready to accept snoop address. 





ACSNOOPM|[3:0] | Input Snoop request type. 





ACVALIDM Input Snoop address valid. 














Table A-31 ACE coherency response channel signals 





Signal Direction | Description 





CRREADYM _ | Input Slave ready to accept snoop response 





CRVALIDM Output Snoop response 

















CRRESPM[4:0] | Output Snoop response valid 





Table A-32 ACE coherency data channel handshake signals 





Signal Direction | Description 





CDDATAM[127:0] | Output Snoop data 























CDLASTM Output Snoop data last transform 
CDREADYM Input Slave ready to accept snoop data 
CDVALIDM Output Snoop data valid 





Table A-33 ACE read and write acknowledge signals 





Signal Direction | Description 





RACKM | Output Read acknowledge 





WACKM | Output Write acknowledge 
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A.12 ACE interface signals 


Related information 


A3.1 Clocks on page A3-48. 
ARM® AMBA® AXI and ACE Protocol Specification AXI3, AXI4, and AXI4-Lite, and ACE and ACE- 


Lite. 
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A Signal Descriptions 
A.13 CHI interface signals 


The CHI protocol supports clock, configuration, data handling, and address map signals when the 
processor uses this protocol for the master memory interface. 


This interface exists only if the processor is configured to have the CHI interface. 


Table A-34 CHI clock and configuration signals 




















Signal Direction | Description 

SCLKEN Input CHI interface bus clock enable 
SINACT Input CHI snoop active 

NODEID[6:0] Input Cortex-A35 CHI Node Identifier 
RXSACTIVE Input Receive pending activity indicator 
TXSACTIVE Output Transmit pending activity indicator 





RXLINKACTIVEREQ | Input 


Receive link active request 





RXLINKACTIVEACK | Output 


Receive link active acknowledge 





TXLINKACTIVEREQ | Output 


Transmit link active request 





TXLINKACTIVEACK | Input 


Transmit link active acknowledge 











REQMEMATTR{7:0] | Output 








Request memory attributes 





Table A-35 CHI transmit request virtual channel signals 











Signal Direction | Description 
TXREQFLITPEND | Output Transmit request flit pending 
TXREQFLITV Output Transmit request flit valid 





TXREQFLIT[99:0] 


Output Transmit request flit payload 








TXREQLCRDV 








Input Transmit request link-layer credit valid 








Table A-36 CHI transmit response virtual channel signals 




















Signal Direction | Description 

TXRSPFLITPEND | Output Transmit response flit pending 
TXRSPFLITV Output Transmit response flit valid 
TXRSPFLIT[44:0] | Output Transmit response flit 

TXRSPLCRDV Input Transmit response link-layer credit valid 











Table A-37 CHI transmit data virtual channel signals 





Signal 


Direction | Description 





TXDATFLITPEND | Output 


Transmit data flit pending 





TXDATFLITV 


Output 


Transmit data flit valid 





TXDATFLIT[193:0] | Output 


Transmit data flit 








TXDATLCRDV 





Input 





Transmit data link-layer credit valid 
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A.13 CHI interface signals 


Table A-38 CHI receive snoop virtual channel signals 





























Signal Direction | Description 

RXSNPFLITPEND | Input Receive snoop flit pending 
RXSNPFLITV Input Receive snoop flit valid 
RXSNPFLIT [64:0] | Input Receive snoop flit 

RXSNPLCRDV Output Receive snoop link-layer credit valid 





Table A-39 CHI receive response virtual channel signals 





























Signal Direction | Description 

RXRSPFLITPEND | Input Receive response flit pending 
RXRSPFLITV Input Receive response flit valid 
RXRSPFLIT[44:0] | Input Receive response flit 

RXRSPLCRDV Output Receive response link-layer credit valid 





Table A-40 CHI receive Data virtual channel signals 





























Signal Direction | Description 
RXDATFLITPEND | Input Receive data flit pending 
RXDATFLITV Input Receive data flit valid 
RXDATFLIT[193:0] | Input Receive data flit 

RXDATLCRDV Output Receive data link-layer credit valid 





Table A-41 CHI system address map signals 







































































Signal Direction | Description 
SAMADDRMAPO([1:0] | Input Region mapping, 0 — 512MB 
SAMADDRMAPI[1:0] | Input Region mapping, 512MB — 1GB 
SAMADDRMAP2([1:0] | Input Region mapping, 1GB — 1.5GB 
SAMADDRMAP3([1:0] | Input Region mapping, 1.5GB — 2GB 
SAMADDRMAP4([1:0] | Input Region mapping, 2GB — 2.5GB 
SAMADDRMAPS5([1:0] | Input Region mapping, 2.5GB — 3GB 
SAMADDRMAP6[1:0] | Input Region mapping, 3GB — 3.5GB 
SAMADDRMAP7[1:0] | Input Region mapping, 3.5GB — 4GB 
SAMADDRMAP8([1:0] | Input Region mapping, 4GB — 8GB 
SAMADDRMAP9[1:0] | Input Region mapping, 8GB — 16GB 
SAMADDRMAP10[1:0] | Input Region mapping, 16GB — 32GB 
SAMADDRMAPI11[1:0] | Input Region mapping, 32GB — 64GB 
SAMADDRMAP12[1:0] | Input Region mapping, 64GB — 128GB 
SAMADDRMAP13[1:0] | Input Region mapping, 128GB — 256GB 
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A.13 CHI interface signals 


Table A-41 CHI system address map signals (continued) 
























































Signal Direction | Description 
SAMADDRMAP14[1:0] | Input Region mapping, 256GB — 512GB 
SAMADDRMAPI15[1:0] | Input Region mapping, 512GB — 1TB 
SAMMNBASE[39:24] Input MN base address 

SAMMNBASE must reside in a SAMADDRMAPx{[1:0] that corresponds to the HN-I. 
SAMMNNODEID[6:0] | Input MN node ID 
SAMHNIONODEID/[6:0] | Input HN-I 0 node ID 
SAMHNIINODEID/[6:0] | Input HN-I 1 node ID 
SAMHNFONODEID [6:0] | Input HN-F 0 node ID 
SAMHNFINODEID[6:0] | Input HN-F 1 node ID 
SAMHNEF2NODEID [6:0] | Input HN-F 2 node ID 
SAMHNF3NODEID [6:0] | Input HN-F 3 node ID 
SAMHNF4NODEID [6:0] | Input HN-F 4 node ID 
SAMHNF5NODEID [6:0] | Input HN-F 5 node ID 
SAMHNF6NODEID [6:0] | Input HN-F 6 node ID 
SAMHNF7NODEID [6:0] | Input HN-F 7 node ID 
SAMHNFMODE2:0] Input HN-F interleaving module 
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A.14 Debug signals 


The processor has the following debug signals. 


Table A-42 Debug signals 





Signal Direction | Description 





DBGROMADDR{[39:12] | Input Debug ROM base address. 
Specifies bits[39:12] of the ROM table physical address. 
If the address cannot be determined, tie this signal LOW. 


This signal is sampled only during processor reset. 





DBGROMADDRV Input Debug ROM base address valid. 
If the debug ROM address cannot be determined, tie this signal LOW. 


This signal is sampled only during processor reset. 

















DBGACK[CN:0] Output Debug acknowledge: 
(2) External debug request not acknowledged. 
1 External debug request acknowledged. 
nCOMMIRQ|[CN:0] Output Communications channel receive or transmit interrupt request 
(2) Request interrupt. 
1 No interrupt request. 
COMMRX[CN:0] Output Communications channel receive. Receive portion of Data Transfer Register full flag: 
(2) Empty. 
1 Full. 
COMMTX[CN:0] Output Communication transmit channel. Transmit portion of Data Transfer Register empty flag: 
(2) Full. 
1 Empty. 
EDBGRQ[CN:0] Input External debug request: 
(2) No external debug request. 
1 External debug request. 


The processor treats the EDBGRQ input as level-sensitive. The EDBGRQ input must be 
asserted until the processor asserts DBGACK. 


























DBGEN[CN:0] Input Invasive debug enable: 
(2) Not enabled. 
1 Enabled. 

NIDEN[CN:0] Input Non-invasive debug enable: 
(2) Not enabled. 
1 Enabled. 
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Table A-42 Debug signals (continued) 


























Signal Direction | Description 
SPIDEN[CN:0] Input Secure privileged invasive debug enable: 
e Not enabled. 
1 Enabled. 
SPNIDEN[CN:0] Input Secure privileged non-invasive debug enable: 
e Not enabled. 
1 Enabled. 
DBGRSTREQ[CN:0] Output Warm reset request. 
DBGNOPWRDWN[CN:0] | Output Request not to power down the core: 
(2) Do not request that the core stays powered up. 
1 Request that the core stays powered up. 
DBGPWRUPREQ[CN:0] | Output Core power- up request: 
(2) Do not request that the core is powered up. 
1 Request that the core is powered up. 
DBGPWRDUP[CN:0] Input Core powered up: 
e Core is powered down. 
1 Core is powered up. 
DBGLIRSTDISABLE Input Disable the automatic invalidation of the L1 data cache at processor reset: 











(2) Enable automatic invalidation of L1 data cache on reset. 


1 Disable automatic invalidation of L1 data cache on reset. 


This signal is sampled only during processor reset. 








Related information 

Chapter C1 Debug on page C1-549. 

Chapter C6 AArch32 debug registers on page C6-593. 
Chapter C7 AArch64 debug registers on page C7-607. 
Chapter C8 Memory-mapped debug registers on page C8-615. 
Chapter C9 ROM table on page C9-641. 
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A.15 APB interface signals 
The debug APB bus supports clock, reset, addressing, and data handling signals when the processor 
includes an APB interface to provide access to the debug and performance monitoring registers. 
You must balance all APB interface signals with respect to CLKIN and time them relative to 
PCLKENDBG. 
Table A-43 APB interface signals 
Signal Direction | Description 
nPRESETDBG Input APB reset, active-LOW: 
(2) Apply reset to APB interface. 
1 Do not apply reset to APB interface. 
PADDRDBG[21:2] | Input APB address bus. 
PADDRDBG31 Input APB address bus bit[31]: 
(2) Not an external debugger access. 
1 External debugger access. 
PCLKENDBG Input APB clock enable. 
PENABLEDBG Input Indicates the second and subsequent cycles of an APB transfer. 
PRDATADBG{[31:0] | Output APB read data. 
PREADYDBG Output APB slave ready. 
An APB slave can deassert PREADYDBG to extend a transfer by inserting wait states. 
PSELDBG Input Debug bus access. 
PSLVERRDBG Output APB slave transfer error: 
e No transfer error. 
1 Transfer error. 
PWDATADBG{[31:0] | Input APB write data. 
PWRITEDBG Input APB read or write signal: 











(2) Reads from APB. 
1 Writes to APB. 
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A Signal Descriptions 
A.16 ATB interface signals 


The ATB bus supports clock and data handling signals when the processor includes an ATB interface for 


each core to output trace information for debugging. 


This interface exists only if the processor is configured to have one or more ETMs. 


You must balance all ATB interface signals with respect to CLKIN and time them relative to 


















































ATCLKEN. 
Table A-44 ATB interface signals 
Signal Direction | Description 
ATCLKEN Input ATB clock enable 
ATREADYMx Input ATB device ready 
AFVALIDMx Input FIFO flush request 
ATDATAMx{[31:0] | Output Data 
ATVALIDMx Output Data valid 
ATBYTESMx[1:0] | Output Data size 
AFREADYMx Output FIFO flush finished 
ATIDMx[6:0] Output Trace source ID 
SYNCREQMx Input Synchronization request from the trace sink 
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A Signal Descriptions 
A.17 ETM signals 


The processor has signals to receive information from an external trace device. 


This interface exists only if the processor is configured to have one or more ETMs. 


Table A-45 ETM signals 





Signal 


Direction 


Description 








TSVALUEB[63:0] 





Input 








Timestamp in binary encoding 
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A.18 PMU interface signals 


The processor uses the PMU signals to communicate with the external performance monitoring device. 


A Signal Descriptions 


A.18 PMU interface signals 


Table A-46 PMU interface signals 

















Signal Direction | Description 
PMUEVENTX[29:0] | Output PMU event bus 
nPMUIRQ[CN:0] Output PMU interrupt request 
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A.19 CTI interface signals 


The processor supports various cross-trigger signals when it implements the CTI. 


A Signal Descriptions 
A.19 CTI interface signals 


Table A-47 CTI interface signals 






































Signal Direction | Description 

CTICHIN{3:0] Input Channel In 
CTICHOUTACKJ3:0] | Input Channel Out acknowledge 
CTICHOUT{3:0] Output Channel Out 
CTICHINACK{3:0] Output Channel In acknowledge 
CISBYPASS Input Channel interface sync bypass 
CIHSBYPASS[3:0] Input Channel interface H/S bypass 
CTITRQ[CN:0] Output CTI interrupt, active-HIGH 
CTITRQACK[CN:0] | Input CTI interrupt acknowledge 
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A.20 DFT interface signals 


The processor uses the DFT signals to communicate with the external test device. 


Table A-48 DFT interface signals 



































Signal Direction | Description 
DFTRAMHOLD _ | Input Disable the RAM chip select during scan testing 
DFTRSTDISABLE | Input Disable internal synchronized reset during scan shift 
DFTCGEN Input Clock gate enable, forces on the clock grids during scan shift 
DFTMCPHOLD Input Disable Multicycle Paths on RAM interfaces 
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A.21 MBIST interface signals 


The processor does not include an external MBIST address and data interface port. The MBIST address 
and data interface ports are internally tied-off in the design, and you can insert MBIST into the design 
before synthesis. The process of adding MBIST into the design can be done automatically by an EDA 


























MBIST tool. 
Table A-49 MBIST interface signals 
Signal Direction | Description 
MBISTREQ Input MBIST test request 
nMBISTRESET | Input MBIST reset 
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Appendix B 
AArch32 UNPREDICTABLE Behaviors 


The cases in which the Cortex-A35 processor implementation diverges from the preferred behavior 
described in ARMv8 AArch32 UNPREDICTABLE behaviors. 


It contains the following sections: 

¢ B.1 Use of R15 by Instruction on page Appx-B-846. 

e B.2 UNPREDICTABLE instructions within an IT Block on page Appx-B-847. 
¢ B.3 Load/Store accesses crossing page boundaries on page Appx-B-848. 

* B.4 ARMv8 Debug UNPREDICTABLE behaviors on page Appx-B-849. 

e B.5 Other UNPREDICTABLE behaviors on page Appx-B-853. 
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B AArch32 UNPREDICTABLE Behaviors 
B.1 Use of R15 by Instruction 


B.1 Use of R15 by Instruction 


If the use of R15 as a base register for a load or store is UNPREDICTABLE, the value used by the load or store 
using R15 as a base register is the Program Counter (PC) with its usual offset and, in the case of T32 
instructions, with the forced word alignment. In this case, if the instruction specifies Writeback, then the 
load or store is performed without Writeback. 


The Cortex-A35 processor does not implement a Read 0 or Ignore Write policy on UNPREDICTABLE use of 
R15 by instruction. Instead, the Cortex-A35 processor takes an UNDEFINED exception trap. 
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B.2 UNPREDICTABLE instructions within an IT Block 


Conditional instructions within an IT Block, described as being unpredictable in the ARM® Architecture 
Reference Manual ARMv8, for ARMv8-A architecture profile pseudo-code, are executed unconditionally. 


The Cortex-A35 processor does not implement an unconditional execution policy for the following 
instructions. Instead all execute conditionally: 

e NEON instructions new to ARMV8. 

e All instructions in the ARMv8 Cryptographic Extensions. 

e CRC32. 
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B.3 Load/Store accesses crossing page boundaries 


The Cortex-A35 processor implements a set of behaviors for load or store accesses that cross page 
boundaries. 


Crossing a page boundary with different memory types or shareability attributes 
The ARM” Architecture Reference Manual ARMVv%, for ARMv8-A architecture profile, states that 
a memory access from a load or store instruction that crosses a page boundary to a memory 
location that has a different memory type or shareability attribute results in CONSTRAINED 
UNPREDICTABLE behavior. 


Crossing a 4KB boundary with a Device access 
The ARM” Architecture Reference Manual ARMV8, for ARMv8-A architecture profile, states that 
a memory access from a load or store instruction to Device memory that crosses a 4KB 
boundary results in CONSTRAINED UNPREDICTABLE behavior. 
Implementation (for both page boundary specifications) 
For an access that crosses a page boundary, the Cortex-A35 processor implements the following 
behaviors: 
e Store crossing a page boundary: 
— No alignment fault. 
— The access is split into two stores. 
— Each store uses the memory type and shareability attributes associated with its own 
address. 
e Load crossing a page boundary (Device to Device and Normal to Normal): 
— No alignment fault. 
— The access is split into two loads. 
— Each load uses the memory type and shareability attributes associated with its own 
address. 
e Load crossing a page boundary (Device to Normal and Normal to Device): 
— The instruction might generate an alignment fault. 
— Ifno fault is generated, the access is split into two loads. 
— Each load uses the memory type and shareability attributes associated with its own 
address. 
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ARMv8 Debug UNPREDICTABLE behaviors 


This section describes the behavior that the Cortex-A35 processor implements when: 


e A topic has multiple options. 
e The behavior differs from either or both of the Options and Preferences behaviors. 


Note 





This section does not describe the behavior when a topic only has a single option and the processor 
implements the preferred behavior. 





Table B-1 ARMv8 Debug UNPREDICTABLE behaviors 





Scenario 


Behavior 





A32 BKPT instruction with condition code 
not AL 


The processor implements the following preferred option: 
¢ Executed unconditionally. 





Address match breakpoint match only on 
second halfword of an instruction 


The processor generates a breakpoint on the instruction, unless it is a breakpoint on 
the second half of the first 32-bit instruction. In this case the breakpoint is taken on the 
following instruction. 





Address matching breakpoint on A32 
instruction with DBGBCRn.BAS=1100 


The processor implements the following option: 
* Does match. 





Address match breakpoint match on T32 
instruction at DBGBCRn+2 with 
DBGBCRn.BAS=1111 


The processor implements the following option: 
* Does match. 





Address mismatch breakpoint match on T32 
instruction at DBGBCRn +2 with 
DBGBCRn.BAS=1111 


The processor implements the following option: 
* Does match. 





Other mismatch breakpoint matches any 
address in current mode and state 


The processor implements the following option: 
¢ Immediate breakpoint debug event. 





Mismatch breakpoint on branch to self 


The processor implements the following option: 


e Instruction is stepped an UNKNOWN number of times, while it continues to branch 
to itself. 





Link to non-existent breakpoint or breakpoint 
that is not context-aware 


The processor implements the following option: 


e No Breakpoint or Watchpoint debug event is generated, and the LBN field of the 
linker reads UNKNOWN. 





DBGWCRn_EL1.MASK!=00000 and 
DBGWCRn EL1.BAS!=11111111 


The processor behaves as indicated in the sole Preference: 
e DBGWCRn_EL1.BAS is ignored and treated as if @x11111111. 





Address-matching Vector catch on 32-bit T32 
instruction at (vector-2) 


The processor implements the following option: 
* Does match. 





Address-matching Vector catch on 32-bit T32 
instruction at (vector+2) 


The processor implements the following option: 
* Does match. 





Address-matching Vector catch and 
Breakpoint on same instruction 








The processor implements the following option: 
¢ Report Breakpoint. 
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Table B-1 ARMv8 Debug UNPREDICTABLE behaviors (continued) 





Scenario 


Behavior 





Address match breakpoint with 
DBGBCRn_EL1.BAS=0000 


The processor implements the following option: 
e As if disabled. 





DBGWCRn_EL1.BAS specifies a non- 
contiguous set of bytes within a double-word 


The processor implements the following option: 
e A Watchpoint debug event is generated for each byte. 





A32 HLT instruction with condition code not 
AL 


The processor implements the following option: 
¢ Executed unconditionally. 





Execute instruction at a given EL when the 
corresponding EDECCR bit is 1 and Halting 
is allowed 


The processor behaves as follows: 


e Generates debug event and Halt no later than the instruction following the next 
Context Synchronization operation (CSO) excluding ISB instruction. 





Unlinked Context matching and Address 
mismatch breakpoints taken to Abort mode 


The processor implements the following option: 

e A Prefetch Abort debug exception is generated. Because the breakpoint is 
configured to generate a breakpoint at PL1, the instruction at the Prefetch Abort 
vector generates a Vector catch debug event. 





Note 


The debug event is subject to the same CONSTRAINED UNPREDICTABLE behavior, 
therefore the Breakpoint debug event is repeatedly generated an UNKNOWN number of 
times. 








Vector catch on Data or Prefetch abort, and 
taken to Abort mode 


The processor implements the following option: 
e A Prefetch Abort debug exception is generated. If Vector catch is enabled on the 
Prefetch Abort vector, this generates a Vector catch debug event. 





Note 


The debug event is subject to the same CONSTRAINED UNPREDICTABLE behavior, 
therefore the Breakpoint debug event is repeatedly generated an UNKNOWN number of 
times. 








H >N or H = 0 at Non-secure EL1 and ELO, 
including value read from PMCR_ELO.N 


The processor implements: 

« A simple implementation where all of HPMN[4:0] are implemented, and In Non- 
secure EL1 and ELO: 
— IfH>N thenMEN. 
— IfH=0 then M =0. 





H > N or H = 0: value read back in 
MDCR_EL2.HPMN 


The processor implements: 


e A simple implementation where all of HPMN[4:0] are implemented and for reads 
of MDCR_EL2.HPMN, return H. 





P > M and P #31: reads and writes of PM 
XEVTYPER_ELO and PMXEVCNTR_ELO 


The processor implements: 
e A simple implementation where all of SEL[4:0] are implemented, and if P > M 
and P # 31 then the register is RESO. 





P > M and P #31: value read in 
PMSELR_ELO.SEL 








The processor implements: 
e A simple implementation where all of SEL[4:0] are implemented, and if P > M 
and P # 31 then the register is RESO. 
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Table B-1 ARMv8 Debug UNPREDICTABLE behaviors (continued) 





Scenario 


Behavior 





P =31: reads and writes of 
PMXEVCNTR_ELO 


The processor implements: 
e RESO. 





n > M: Direct access to PMEVCNTRn _ ELO 
and PMEVTYPERn ELO 


The processor implements: 


¢ Ifn>N, then the instruction is UNALLOCATED. 
e Otherwise ifn > M, then the register is RESO. 





Exiting Debug state while instruction issued 
through EDITR is in flight 


The processor implements the following option: 
¢ The instruction completes in Debug state before executing the restart. 





Using memory-access mode with a non-word- 
aligned address 


The processor behaves as indicated in the sole Preference: 


¢ Does unaligned accesses, faulting if these are not permitted for the memory type. 





Access to memory-mapped registers mapped 
to Normal memory 


The processor behaves as indicated in the sole Preference: 

e The access is generated, and accesses might be repeated, gathered, split or resized, 
in accordance with the rules for Normal memory, meaning the effect is 
UNPREDICTABLE. 





Not word-sized accesses or (AArch64 only) 
doubleword-sized accesses 


The processor behaves as indicated in the sole Preference: 


e Reads occur and return UNKNOWN data. 
e Writes set the accessed register(s) to UNKNOWN. 





External debug write to register that is being 
reset 








The processor behaves as indicated in the sole Preference: 


e Takes reset value. 
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Table B-1 ARMv8 Debug UNPREDICTABLE behaviors (continued) 





Scenario 


Behavior 





Accessing reserved debug registers 


The processor deviates from Preferred behavior because the hardware cost to decode 
some of these addresses in debug power domain is significantly high: 


Actual behavior: 
1. 


For reserved debug and Performance Monitors registers the response is 
CONSTRAINED UNPREDICTABLE Error or RESO, when any of the following 
error instead of preferred RESO for reserved debug registers 
@x@00-OxCFC and reserved PMU registers @x000-OxF QO: 


Off 
Core power domain is either completely off, or in a low-power 
state where the Core power domain registers cannot be 
accessed. 

DLK 
DoubleLockStatus() is TRUE, OS double-lock is locked, 
that is, EDPRSR.DLK is 1. 

OSLK 


OSLSR_EL1.OSLK is1, OS lock is locked. 
In addition, for reserved debug registers in the address ranges 0x400 to 
@x4FC and 0x800 to Ox8FC, the response is CONSTRAINED 
UNPREDICTABLE Error or RESO when the conditions in / do not apply and: 


EDAD 
AllowExternalDebugAccess() is FALSE, external debug 
access is disabled. 
For reserved Performance Monitor registers in the address ranges 0x000 
to @x@FC and 0x400 to @x47C, the response is CONSTRAINED 
UNPREDICTABLE Error, or RESO when the conditions in / and 2 do not 
apply, and the following errors instead of preferred res0 for the these 
registers: 


EPMAD 
AllowExternalPMUAccess() is FALSE (external 
Performance Monitors access is disabled). 





when Core power domain is on, and 
DoubleLockStatus() is TRUE 





Clearing the clear-after-read EDPRSR bits 





The processor behaves as indicated in the sole Preference: 


e Bits are not cleared to zero. 
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B.5 Other UNPREDICTABLE behaviors 


This section describes other UNPREDICTABLE behaviors. 


Table B-2 Other UNPREDICTABLE behaviors 








Scenario Description 

CSSELR indicates a If CSSELR indicates a cache that is not implemented, then on a read of the CCSIDR the behavior is 
cache that is not CONSTRAINED UNPREDICTABLE, and can be one of the following: 

implemented. ° The CCSIDR read is treated as NOP. 


¢ The CCSIDR read is UNDEFINED. 
e The CCSIDR read returns an UNKNOWN value (preferred). 





HDCR.HPMN is set to 0, | If HDCR.HPMN is set to 0, or to a value larger than PMCR.N, then the behavior in Non-secure ELO and 
or to a value larger than | EL1 is CONSTRAINED UNPREDICTABLE, and one of the following must happen: 

PMCR.N. ¢ The number of counters accessible is an UNKNOWN non-zero value less than PMCR.N. 

e There is no access to any counters. 


For reads of HDCR.HPMN by EL2 or higher, if this field is set to 0 or to a value larger than PMCR.N, the 

processor must return a CONSTRAINED UNPREDICTABLE value that is one of: 

e PMCR.N. 

¢ The value that was written to HDCR.HPMN. 

e (The value that was written to HDCR.HPMN) modulo 2h, where h is the smallest number of bits 
required for a value in the range 0 to PMCR.N. 
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Appendix C 
Revisions 


This appendix describes the technical changes between released issues of this book. 


It contains the following sections: 
e C.l Revisions on page Appx-C-856. 
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C.1 Revisions 
This section describes the technical changes between released issues of this book. 
Table C-1 Issue 0000-00 
Change Location | Affects 
First release for rOp0. | - - 
Table C-2 Issue 0001-00 
Change Location Affects 





Product name udpated from the 
Mercury processor to the Cortex- 
A35 processor. 


Everywhere the product name is used. 


All versions 





First release for r0p1, revision 
information updated. 


B2.83 Main ID Register, ELI on page B2-492. 
B3.3 CPU Interface Identification Register on page B3-536. 
B3.8 VM CPU Interface Identification Register on page B3-541. 


C8.10 External Debug Peripheral Identification Register 1 on page C8-630. 


C9.8 ROM Table Peripheral Identification Register 2 on page C9-651. 


C10.14 Performance Monitors Peripheral Identification Register 2 
on page C10-690. 


C11.13 Trace ID Register on page C11-718. 
C11.68 ETM Peripheral Identification Register 2 on page C11-781. 
C12.8 CTI Peripheral Identification Register 2 on page C12-800. 


r0pl 





References to CP1SDISABLE 
signal removed. 


B1.1 AArch32 register summary on page B1-146. 

B1.101 Primary Region Remap Register on page B1-310. 
B1.103 Reset Management Register on page B1-314. 
B1.105 System Control Register on page B1-319. 


All versions 





CPUID/Way [20:18] bit field 
description updated. 


B1.44 CPU Memory Error Syndrome Register on page B1-204. 
B2.38 CPU Memory Error Syndrome Register, ELI on page B2-406. 


All versions 





CPUID/Way [21:18] bit field 
description updated. 


B1.94 L2 Memory Error Syndrome Register on page B1-295. 
B2.76 L2 Memory Error Syndrome Register, EL1 on page B2-476. 


All versions 





CCSIDR and CCSIDR_EL1 
encodings table updated. 


B1.39 Cache Size ID Register on page B1-192. 
B2.29 Cache Size ID Register, EL1 on page B2-386. 


All versions 





ICB [31:30] bit field description 
updated. 


LoUIS [23:21] bit field updated. 


B1.40 Cache Level ID Register on page B1-194. 
B2.30 Cache Level ID Register, EL] on page B2-388. 


All versions 





DYNSDIS [11] bit updated. 








B1.42 CPU Auxiliary Control Register on page B1-198. 


All versions 
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Table C-2 Issue 0001-00 (continued) 





Change 


Location 


Affects 





Several reset values updated in 
summary tables. 


B1.12 c9 registers on page B1-161. 
B1.26 AArch32 Performance monitor registers on page B1-176. 
B2.10 AArch64 Performance monitor registers on page B2-361. 


All versions 





PMU events added to PMU events 
table. 


C2.3 Performance monitoring events on page C2-562. 


All versions 








DTAH [24] bit updated. 


B2.36 CPU Auxiliary Control Register, ELI on page B2-400. 


All versions 




















ROM table for v7 added. C9.4 ROM entry registers on page C9-645. All versions 

Table C-3 Issue 0002-00 
Change Location Affects 
First release for r0p2. B2.83 Main ID Register, ELI on page B2-492. r0p2 


B3.3 CPU Interface Identification Register on page B3-536. 

B3.8 VM CPU Interface Identification Register on page B3-541. 

C8.10 External Debug Peripheral Identification Register 1 on page C8-630. 

C9.8 ROM Table Peripheral Identification Register 2 on page C9-651. 

C10.14 Performance Monitors Peripheral Identification Register 2 on page C10-690. 
C11.13 Trace ID Register on page C11-718. 

C11.68 ETM Peripheral Identification Register 2 on page C11-781. 

C12.8 CTI Peripheral Identification Register 2 on page C12-800. 





Bits [9:0] updated in CPTR_EL3 
and HCPTR. 


B2.33 Architectural Feature Trap Register, EL3 on page B2-394. 


B1.60 Hyp Architectural Feature Trap Register on page B1-227 


All versions 





References to internal memory- 
mapped removed. 


B1.96 Main ID Register on page B1-301. 

B1.97 Multiprocessor Affinity Register on page B1-303. 

B2.84 Multiprocessor Affinity Register, EL1 on page B2-494. 

C7.1 AArch64 debug register summary on page C7-608. 

C8.1 Memory-mapped debug register summary on page C8-616. 
C10.1 AArch32 PMU register summary on page C10-662. 

C10.9 Memory-mapped PMU register summary on page C10-683. 
C12.1 Cross trigger register summary on page C12-792. 


All versions 





nSEI, nREI, and nVSEI clarified 
in GIC signals table. 








A.5 GIC signals on page Appx-A-816. 





All versions 
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